Bugs, Coverage, and SDK Wave 2: fix the known bugs the Wave 1 suites pin (legacy-era servers) #5004

Part of the 2026-07-28 Spec Refactor tracker #4857. Wave 2: fix the known bugs that the Wave 1 suites pin, so the legacy-era servers are correct before the SDK migration.

Why

Wave 1 (#4854, #4855) built characterization suites that pin each server's current behavior, bugs included. Every test that pins a bug carries a marker:

KNOWN BUG #N: pins current (wrong) behavior; the fix changes this assertion.

git grep "KNOWN BUG" lists them. If Wave 3's migrations (#4856, #4851) started now, "the suites pass unchanged" would prove only that the bugs survived the port. This wave fixes them first, so by Wave 3 every test asserts expected behavior, and an unchanged suite really does show a transparent migration.

Rules for each fix

• Fix in the legacy-era server, on SDK 1.x (@modelcontextprotocol/sdk@^1, mcp>=1,<2), on v2/main. No SDK upgrade and no 2026-07-28 behavior; those are Waves 3 and 4.
• Change the pinning test's assertion to the correct behavior and remove its KNOWN BUG marker, in the same PR. A fix with no test change has not fixed what the suite pins.
• The per-file 90% coverage gate must still pass.
• One PR per issue, or per small group of issues in one server. Each PR closes its issues by hand on merge, since Closes doesn't auto-close on v2/main.
• Candidate PRs below are outside contributions against main. Treat them as reference and port them with credit (cherry-pick, keep authorship). Don't merge them to main.

Out of scope

• Behavior that comes from SDK 1.x, not the server's code (for example, an unknown tool returned as an isError result, or tools/list answered before initialize). It isn't marked, and Wave 3's migration will show it if the SDK changes it.
• Open design questions with no maintainer ruling (for example get-env dumping the environment, server-everything: get-env returns the full process environment to the client (credential exposure) #4882/server-everything: get-env tool returns full process.env without any filtering #3986), and feature requests pinned as current design (Add missing idempotentHint and openWorldHint to server-filesystem #3402, server-filesystem: MCP roots protocol overwrites CLI-provided allowed directories #3602, fetch: hardcoded 30s timeout with no CLI/env/per-request override #4448, sequentialthinking tool description beyond OpenAI length limitation #799, mcp-server-time: Default Time Zone #2853, [Feature]: Unify the names of the Time MCP server tools #3201).

Dependencies

• After: the Wave 1 PRs (test(sequentialthinking): in-process protocol suite and per-file 90% coverage gate #4970, test(memory): protocol-level characterization suite and per-file 90% coverage gate #4973, test(filesystem): in-process characterization suite and per-file 90% coverage gate #4977, test(everything): protocol-level characterization suite and per-file 90% coverage gate #4978, ci(coverage): enforce the TypeScript per-file coverage gate in CI and local:gate #4969; test(fetch): protocol-level characterization tests and per-file coverage #4971, test(git): characterize serve() through the protocol; per-file 90% coverage #4974, test(time): characterize serve() through the protocol, per-file coverage #4972, chore(python): per-file 90% coverage gate in CI and local:gate (#4855) #4976), which add the suites and the markers.
• Blocks: Spec Refactor Wave 1 Part 1: Migrate TypeScript servers to TS SDK v2 (codemod) #4856 (Part 3) and Spec Refactor Wave 1 Part 2: Migrate Python servers to Python SDK v2 #4851 (Part 4).

Waves

One wave per server, worked in this order. Within a wave the issues are listed by priority, and a wave can be one PR or several. Each wave ends with that server's KNOWN BUG markers gone (git grep "KNOWN BUG" -- src/<server>/ returns nothing). Waves 1–4 are the TypeScript servers and unblock #4856 (Part 3). Waves 5–7 are the Python servers and unblock #4851 (Part 4). #360 spans fetch, git and time and is fixed in wave 5 for all three.

Wave 1: everything (10)

Wave 2: filesystem (9)

Wave 3: memory (4)

Wave 4: sequentialthinking (3)

Wave 5: fetch (7)

Wave 6: git (12)

Wave 7: time (3)

Done when

• Waves 1–7 are done: every sub-issue is closed.
• git grep "KNOWN BUG" -- src/ on v2/main returns nothing.
• CI and npm run local:gate pass, including the per-file coverage gate.