Make MCP working-directory validation regex-portable

[jonathanhefner]

Problem

The mcp.json schema validates cwd with one regular expression containing noncapturing groups and $ alternatives. Noncapturing groups are outside the portable regular-expression subset recommended by JSON Schema, and $ has different end-of-string behavior across regular-expression engines.

In particular, Python-style engines allow $ to match before a terminal newline. They therefore accept ${PLUGIN_ROOT}\n and ${PLUGIN_DATA}\n, although neither value has one of the forms required by §7.2.1.

Resolution

Replace the single expression with anyOf alternatives that represent the accepted forms directly:

• A plugin-relative path beginning with ./.
• Exactly ${PLUGIN_ROOT}.
• A path beginning with ${PLUGIN_ROOT}/.
• Exactly ${PLUGIN_DATA}.
• A path beginning with ${PLUGIN_DATA}/.

Use const for the exact placeholder values and simple start-anchored patterns for the prefix forms. This removes both noncapturing groups and end anchors while preserving the cwd constraints defined by §7.2.1.

anyOf expresses the actual requirement: a value must have at least one accepted form. The alternatives happen to be mutually exclusive, but it is not a separate contract to enforce with oneOf.

The correction applies to the 1.1.0 working draft. The published 1.0.0 schema retains its canonical contents.

Validation

An AI agent:

• Compiled schemas/1.1.0/mcp.schema.json as Draft 2020-12 with Ajv.
• Compared the replacement assertions with the §7.2.1 predicate across 100 representative values in Node and Python with no mismatches.
• Confirmed that the current expression drifts from §7.2.1 for the two terminal-newline placeholder values under Python-style matching.

---

Follow-up to #79.