mcp: initialize fails against Java MCP servers over unrecognized elicitation.form.applyDefaults field #52758

Summary

Remote MCP servers backed by the Java MCP SDK (io.modelcontextprotocol) with strict Jackson deserialization reject OpenCode's initialize request because OpenCode's bundled MCP client declares capabilities.elicitation.form.applyDefaults. The server fails before OpenCode ever attempts to authenticate, so this breaks both unauthenticated and OAuth-gated remote servers equally.

Reproduced against Spotify's Confidence MCP servers (https://confidence.spotify.com/docs/sdks/mcp-servers), but this will affect any MCP server using the Java SDK's default (non-ignoring) Jackson config for ClientCapabilities.

Environment

• opencode version: 2.0.19
• OS: Darwin 25.6.0 (darwin arm64)
• Terminal: tmux (TERM=xterm-256color, TERM_PROGRAM=tmux, COLORTERM=truecolor)
• Shell: /bin/zsh
• Install/channel: latest
• Active plugins: @plannotator/opencode@latest, slack

Reproduction

1. Add a remote MCP server backed by a Java-SDK MCP server, e.g.:

   {
     "mcp": {
       "servers": {
         "confidence-docs": {
           "type": "remote",
           "url": "https://mcp.confidence.dev/mcp/docs"
         },
         "confidence-flags": {
           "type": "remote",
           "url": "https://mcp.confidence.dev/mcp/flags"
         }
       }
     }
   }

2. Run opencode mcp list.

Expected Behavior

• confidence-docs connects immediately (no auth required per Confidence's docs).
• confidence-flags reaches the "needs authentication" state so the user can sign in via /mcps.

Actual Behavior

Both fail at initialize, before any OAuth flow starts:

✗ confidence-docs   failed: Unrecognized field "applyDefaults" (class io.modelcontextprotocol.spec.McpSchema$ClientCapabilities$Elicitation$Form), not marked as ignorable (0 known properties: )
 at [Source: UNKNOWN; byte offset: #UNKNOWN] (through reference chain: io.modelcontextprotocol.spec.McpSchema$InitializeRequest["capabilities"]->io.modelcontextprotocol.spec.McpSchema$ClientCapabilities["elicitation"]->io.modelcontextprotocol.spec.McpSchema$ClientCapabilities$Elicitation["form"]->io.modelcontextprotocol.spec.McpSchema$ClientCapabilities$Elicitation$Form["applyDefaults"])
✗ confidence-flags  failed: Unrecognized field "applyDefaults" (class io.modelcontextprotocol.spec.McpSchema$ClientCapabilities$Elicitation$Form), not marked as ignorable (0 known properties: )
 at [Source: UNKNOWN; byte offset: #UNKNOWN] (through reference chain: io.modelcontextprotocol.spec.McpSchema$InitializeRequest["capabilities"]->io.modelcontextprotocol.spec.McpSchema$ClientCapabilities["elicitation"]->io.modelcontextprotocol.spec.McpSchema$ClientCapabilities$Elicitation["form"]->io.modelcontextprotocol.spec.McpSchema$ClientCapabilities$Elicitation$Form["applyDefaults"])

Notably, packages/opencode/src/mcp/index.ts currently has the elicitation client capability commented out:

const CLIENT_OPTIONS = {
  capabilities: {
    // https://github.com/anomalyco/opencode/issues/11948
    // sampling: {},
    // https://github.com/anomalyco/opencode/issues/23066
    // elicitation: {},
    // https://github.com/anomalyco/opencode/issues/2308
    roots: {},
    // https://github.com/anomalyco/opencode/issues/28567
    // tasks: {},
  },
} satisfies ClientOptions

...yet the wire-level initialize request still includes capabilities.elicitation.form.applyDefaults. This suggests the bundled @modelcontextprotocol/sdk client injects a default elicitation.form.applyDefaults capability (likely in its own mergeCapabilities/baseline logic) regardless of what CLIENT_OPTIONS passes, overriding the app-level opt-out.

Additional Context

• Tried setting "protocol": "auto" on confidence-docs as a workaround — different failure, not a fix: Version negotiation failed: the server answered the probe with HTTP 500 (the server doesn't support the 2026-07-28 server/discover probe either).
• No existing mcp.servers.<name> config field (type, url, headers, oauth, disabled, codemode, timeout, protocol) can disable/strip this client capability.
• This matches other known strict-Java-MCP-SDK elicitation issues where the client declares a nested elicitation.form object that the Java SDK's Jackson deserializer doesn't mark ignorable (e.g. VSCode mcp tool connection fails with Unrecognized field "form" jenkinsci/mcp-server-plugin#117, MCP server fails to initialize with VS Code Insiders: Unrecognized field "form" in elicitation capabilities scalameta/metals#8015).
• Related: fix(mcp): restore legacy SDK compatibility #39373 ("fix(mcp): restore legacy SDK compatibility") reverted a similar MCP SDK v2 regression for other servers (Xcode MCP, Atlassian OAuth, Draft-07 schema rejection, ReUI OAuth, missing server/discover fallback) around the same @modelcontextprotocol/sdk client. This looks like a residual/separate case: the app-level opt-out via CLIENT_OPTIONS.capabilities.elicitation being commented out is not actually preventing the field from being sent on the wire.
• Workarounds tried: none successful. The only fix available today is on the server side (the MCP server disabling Jackson's FAIL_ON_UNKNOWN_PROPERTIES for ClientCapabilities.Elicitation.Form), which is out of OpenCode's control to request from every third-party server.