[BUG] Windows MSIX 1.32352.1.0: local filesystem MCP server unusable in Cowork sessions - draft-07 outputSchema rejected, and no server version passes both checks

Summary

After a silent MSIX auto-update to Claude Desktop 1.32352.1.0, the local filesystem MCP server can no longer be used by Cowork/Code sessions, which spawn their own copy of the server. The client rejects the server at registration because its schemas declare JSON Schema draft-07.

Critically, no version of @modelcontextprotocol/server-filesystem works: recent versions are rejected for their draft-07 outputSchema, and older versions are rejected because their inputSchema lacks type: "object". The two defects swap places in the same release, so downgrading is not a workaround.

This appears to be the Cowork-proxy variant of the regression cluster reported in #80094, #79986 and anthropics/claude-ai-mcp#664, with the added data point of an exact install timestamp correlated with the moment of breakage.

Environment

  |  
-- | --
Claude Desktop | 1.32352.1.0 (MSIX, Claude_1.32352.1.0_x64__pzs8sxrjxfjjc)
OS | Windows x64
Surface | Cowork session (remote container reaching the local MCP server through the desktop bridge)
MCP server | @modelcontextprotocol/server-filesystem, launched via npx

The inputSchema fix and the outputSchema introduction landed in the same release (2025.11.25). There is no version in between to pin.

This violates the spec the client implements

SEP-1613 (status: Final) establishes 2020-12 as the default dialect, but explicitly states that schemas MAY declare a different dialect via $schema, and that clients MUST "validate schemas according to declared or default dialect".

Rejecting a schema because it declares draft-07 is therefore non-conformant. The underlying SDK bug is tracked in modelcontextprotocol/typescript-sdk#2532 — classified as a regression introduced in @modelcontextprotocol/client@2.0.0-beta.4, still open. As that issue notes, zod-to-json-schema stamps draft-07 on every schema produced by v1-era servers, so there is no server-side remedy.

Reproduction

1. Configure a local MCP server: command npx, args -y @modelcontextprotocol/server-filesystem@2026.1.14 <some folder>.


2. Confirm it works from a normal chat session (it does — the chat path does not apply this validation).


3. Open a Cowork session and call any filesystem tool.


4. Observe the unsupported dialect error; no request ever reaches the server process.


5. Re-pin to @2025.8.21 and restart: the server now fails to register at all with the inputSchema error.

Workaround

A thin stdio proxy that spawns the real server, passes everything through unchanged, and rewrites only the $schema field of outputSchema to https://json-schema.org/draft/2020-12/schema in the tools/list response. Verified end-to-end: 14 tools exposed, valid inputSchema, accepted dialect, real tools/call succeeding.

This matches the finding in #80094 that a custom server declaring only inputSchema works fine in the same session — the schemas themselves are not the problem, only the declared dialect is.

Expected behavior

The client should accept schemas that explicitly declare draft-07, as SEP-1613 requires — for example by dispatching to a validator matching the declared $schema instead of assuming 2020-12.

Secondarily: a schema-validation failure should not be reported to users as "Couldn't start this server", and internal validator instructions (pass a pre-configured Ajv instance) should not appear in user-facing error text.

Additional notes

• The bridge enumerates local MCP servers at session start and does not re-register them live: after any connector change, a brand-new Cowork session is required to see the effect. This makes the failure considerably harder to diagnose.


• Because updates arrive through MSIX in the background, there is no visible signal connecting the breakage to an app update. The only reliable check is (Get-Item "<InstallLocation>").CreationTime.

Related

• #80094 — macOS, filesystem MCP unusable in both package generations


• #79986 — Windows MSIX 1.24012.1, tools/call never sent


• #25081 — client drops all tools when server includes outputSchema


• anthropics/claude-ai-mcp#664 — tool calls never reach filesystem servers


• modelcontextprotocol/typescript-sdk#2532 — root cause in the default validator

## Summary

After a **silent MSIX auto-update to Claude Desktop 1.32352.1.0**, the local `filesystem` MCP server can no longer be used by **Cowork/Code sessions**, which spawn their own copy of the server. The client rejects the server at registration because its schemas declare JSON Schema draft-07.

Critically, **no version of `@modelcontextprotocol/server-filesystem` works**: recent versions are rejected for their draft-07 `outputSchema`, and older versions are rejected because their `inputSchema` lacks `type: "object"`. The two defects swap places in the same release, so downgrading is not a workaround.

This appears to be the Cowork-proxy variant of the regression cluster reported in #80094, #79986 and anthropics/claude-ai-mcp#664, with the added data point of an **exact install timestamp correlated with the moment of breakage**.

## Environment

| | |
|---|---|
| Claude Desktop | **1.32352.1.0** (MSIX, `Claude_1.32352.1.0_x64__pzs8sxrjxfjjc`) |
| OS | Windows x64 |
| Surface | Cowork session (remote container reaching the local MCP server through the desktop bridge) |
| MCP server | `@modelcontextprotocol/server-filesystem`, launched via `npx` |

## Timeline (exact)

| Time (2026-08-18, local) | Event |
|---|---|
| before ~09:59 | Local `filesystem` connector working normally from Cowork sessions, config **without a version pin** |
| **09:59:29** | `Claude 1.32352.1.0` installed — `(Get-Item ).CreationTime`. Silent MSIX background update, no prompt, no notification |
| **10:15:47** | `%LOCALAPPDATA%\Claude-Data` created (first launch of the new build) |
| after | Connector no longer usable from Cowork sessions |

No configuration was changed by the user between the working and broken states. Every other Claude installation directory on the machine dates from March–May 2026; only these two artifacts are from this morning.

## Errors observed

**With any version ≥ 2025.11.25** (tools appear, then every call fails):

```
Tool 'list_directory' has an invalid outputSchema: JSON Schema declares an unsupported
dialect ("$schema": "http://json-schema.org/draft-07/schema#"). The default validator
supports JSON Schema 2020-12 only; pass a pre-configured Ajv instance to Ajv...
```

**With any version ≤ 2025.8.21** (server fails to register at all):

```
MCP filesystem: Couldn't start this server for Cowork and Code sessions (they run their
own copy of it), so they can't use its tools: Invalid result for tools/list:
[ { "code": "invalid_value", "values": [ "object" ],
"path": [ "tools", 0, "inputSchema", "type" ],
"message": "Invalid input: expected \"object\"" }, ... ]
```

Note the leaked internal validator message (`pass a pre-configured Ajv instance`) — this surfaces `AjvJsonSchemaValidator` from the TypeScript SDK directly to the end user.

## Version matrix — no version passes both checks

Measured by launching each version and inspecting its `tools/list` response over raw stdio:

| version | tools | `inputSchema` missing `type: "object"` | `outputSchema` |
|---|---|---|---|
| 2025.7.1 | 12 | **11 of 12** | none |
| 2025.7.29 | 14 | **13 of 14** | none |
| 2025.8.18 | 14 | **13 of 14** | none |
| 2025.8.21 | 14 | **13 of 14** | none |
| 2025.11.25 | 14 | 0 | **14, draft-07** |
| 2025.12.18 | 14 | 0 | **14, draft-07** |
| 2026.1.14 | 14 | 0 | **14, draft-07** |
| 2026.7.10 | 14 | 0 | **14, draft-07** |

The `inputSchema` fix and the `outputSchema` introduction landed in the **same release** (2025.11.25). There is no version in between to pin.

## This violates the spec the client implements

[[SEP-1613](https://modelcontextprotocol.io/seps/1613-establish-json-schema-2020-12-as-default-dialect-f)](https://modelcontextprotocol.io/seps/1613-establish-json-schema-2020-12-as-default-dialect-f) (status: **Final**) establishes 2020-12 as the *default* dialect, but explicitly states that schemas **MAY** declare a different dialect via `$schema`, and that clients **MUST** "validate schemas according to declared or default dialect".

Rejecting a schema *because* it declares draft-07 is therefore non-conformant. The underlying SDK bug is tracked in [[modelcontextprotocol/typescript-sdk#2532](https://github.com/modelcontextprotocol/typescript-sdk/issues/2532)](https://github.com/modelcontextprotocol/typescript-sdk/issues/2532) — classified as a regression introduced in `@modelcontextprotocol/client@2.0.0-beta.4`, still open. As that issue notes, `zod-to-json-schema` stamps draft-07 on every schema produced by v1-era servers, so there is **no server-side remedy**.

## Reproduction

1. Configure a local MCP server: command `npx`, args `-y @modelcontextprotocol/server-filesystem@2026.1.14 `.
2. Confirm it works from a normal chat session (it does — the chat path does not apply this validation).
3. Open a Cowork session and call any filesystem tool.
4. Observe the `unsupported dialect` error; no request ever reaches the server process.
5. Re-pin to `@2025.8.21` and restart: the server now fails to register at all with the `inputSchema` error.

## Workaround

A thin stdio proxy that spawns the real server, passes everything through unchanged, and rewrites only the `$schema` field of `outputSchema` to `https://json-schema.org/draft/2020-12/schema` in the `tools/list` response. Verified end-to-end: 14 tools exposed, valid `inputSchema`, accepted dialect, real `tools/call` succeeding.

This matches the finding in #80094 that a custom server declaring only `inputSchema` works fine in the same session — the schemas themselves are not the problem, only the declared dialect is.

## Expected behavior

The client should accept schemas that explicitly declare draft-07, as SEP-1613 requires — for example by dispatching to a validator matching the declared `$schema` instead of assuming 2020-12.

Secondarily: a schema-validation failure should not be reported to users as *"Couldn't start this server"*, and internal validator instructions (`pass a pre-configured Ajv instance`) should not appear in user-facing error text.

## Additional notes

- The bridge enumerates local MCP servers **at session start** and does not re-register them live: after any connector change, a brand-new Cowork session is required to see the effect. This makes the failure considerably harder to diagnose.
- Because updates arrive through MSIX in the background, there is no visible signal connecting the breakage to an app update. The only reliable check is `(Get-Item "").CreationTime`.

## Related

- #80094 — macOS, filesystem MCP unusable in both package generations
- #79986 — Windows MSIX 1.24012.1, `tools/call` never sent
- #25081 — client drops all tools when server includes `outputSchema`
- anthropics/claude-ai-mcp#664 — tool calls never reach filesystem servers
- modelcontextprotocol/typescript-sdk#2532 — root cause in the default validator

Start by reproducing the Cowork session failure with @modelcontextprotocol/server-filesystem@2026.1.14 and inspect the tools/list and tools/call flow. Read the referenced TypeScript SDK issue #2532 and the schema-validation entry point; done means draft-07 outputSchema values are accepted according to their declared dialect and validation errors are presented without internal instructions.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.