Render MCP server icons (serverInfo.icons) in tool lists and permission prompts

Summary

Render serverInfo.icons (MCP spec 2025-11-25, SEP-973) for MCP servers in Claude Code and Claude Desktop, and show that icon on the permission prompt. Today every server is a letter monogram or a globe, so with several servers across several environments the only way to know who is asking is to read the tool name and infer the server. The icon is the fastest signal for "approve this" vs "why is that server calling?".

This re-opens #49040, which was closed by the stale bot with no maintainer comment, and consolidates the earlier tickets that were also closed by bots (#28187, #33004, #44675, #36524, #58015). Nothing in that history is a decision; it is five tickets that timed out.

The use case

I run Claude Code and Claude Desktop against the same MCP servers in more than one environment (local, QA, production variants of the same server, plus several third-party connectors). Permission prompts and tool listings show a monogram derived from the connector name, so:

• two environments of one server look identical, and a wrong letter is worse than no icon (#58015: the monogram comes from a pre-OAuth synthetic identity, not serverInfo.name);
• approving quickly means reading tool names and guessing the server, which is the opposite of what a permission prompt should ask of someone;
• Claude Desktop currently does no favicon lookup at all (anthropics/claude-ai-mcp#152, comment 2026-09-02), and claude.ai uses a Google favicon fetch keyed on a naive apex domain, which gives shared suffixes (vercel.app, github.io, co.za) the platform's logo (#152, #838).

What exists already

• Spec. Revision 2025-11-25 adds icons: Icon[] on Implementation, Tool, Resource, Prompt: { src, mimeType?, sizes?, theme? }, with src an HTTPS URL or a data: URI. The spec carries the security guidance a client needs: reject unsafe schemes and redirects, fetch without credentials, same-origin check, size limits, sniff magic bytes. https://modelcontextprotocol.io/specification/2025-11-25/basic#icons
• SDK. @modelcontextprotocol/server 2.x accepts icons on the server and, since PR modelcontextprotocol/typescript-sdk#2353 (merged 2026-06-23), on registerTool / registerPrompt. Servers can emit this today.
• Anthropic already renders icons for Desktop Extensions (modelcontextprotocol/mcpb#154, fixed 2026-02-05) and for first-party connectors. The gap is specific to plain MCP servers.
• Other clients. VS Code renders server, tool and resource icons since v1.107 (https://code.visualstudio.com/updates/v1_107). coder/xum merged a hardened implementation on 2026-09-18 (coder/xum#4278).
• Demand. anthropics/claude-ai-mcp#152 is open with 111 👍 and 93 comments, no Anthropic response since 2026-04-06. Related: #474 (claude.ai rejects an initialize response that carries serverInfo.icons), #1009 (icons before connection via Server Cards).

Proposal

1. Read serverInfo.icons at initialize; pick by sizes/theme; cache per server.
2. Show it in /mcp, the tool list, and the permission prompt header, next to the server name.
3. Fallbacks in order: icons → nothing (keep the monogram). Do not add a third-party favicon fetch; the spec field makes it unnecessary.
4. Apply the spec's security rules: HTTPS or data: only, no redirects, size cap, magic-byte check, fetch without credentials.
5. Optional, same plumbing: icon in plugin.json for marketplace plugins (#28187).

Ask

If this is not planned, a one-line maintainer answer would let the community stop re-filing it (see JaredEzz in #152: "at least just say that"). If it is, the server side is done and the spec text covers the hard parts.

Environment

Claude Code v2.1.278, Claude Desktop 1.406xx, macOS. Server: @modelcontextprotocol/server 2.x over Streamable HTTP, emitting icons in serverInfo.

Start by locating the MCP initialize handling and the entry points for /mcp, tool lists, and permission prompt headers. Trace how server identities and icons are currently represented, then verify that serverInfo.icons can flow through each surface with the stated fallback and security requirements; done means the icon is shown consistently without favicon lookup.