Skills-verification budget-exceeded message names a `--method skills/get --uri` escape hatch with no test asserting it round-trips

Which version line?

v2 — current (@modelcontextprotocol/inspector@latest)

Which client?

All / shared core

Inspector version

2.7.0 (git tag) — static code-review finding, not run locally

Node version

N/A — static code review, no live run performed

Operating system (and browser, for the web client)

N/A — static code review

Transport

Not applicable / never connected

MCP server under inspection

N/A — this is a static code-review finding against the 2.7.0 tag's core/mcp/skillsVerification.ts and its test file, not a live reproduction against a running MCP server.

Steps to reproduce

Found via static review of the 2.7.0 tag source, not a live run.

1. core/mcp/skillsVerification.ts (~line 382) emits, when a run hits its catalog budget: "Not read: this run already reached its catalog budget of ${budget.maxSkills} skills / ${budget.maxBytes} bytes (raise it in the server's Skills settings). Nothing about this skill's files has been checked — verify it on its own with --method skills/get --uri to get a verdict."
2. A repo-wide grep for the string "skills/get --uri" across all test files returns zero matches.
3. So the escape hatch the message tells a user to run has no test confirming that running --method skills/get --uri against a skill that was skipped for budget reasons actually produces the promised verdict (i.e. that it round-trips: skip → follow the suggested command → get a real check).
   No live CLI run was performed; this is based on reading skillsVerification.ts and grepping the test suite against the 2.7.0 tag.

Expected behavior

The --method skills/get --uri command the budget-exceeded message tells users to run is covered by a test proving it actually verifies a skill that was skipped for budget reasons — i.e. the suggested escape hatch is known-good, not just plausible-sounding text in an error message.

Actual behavior

The budget-exceeded message hardcodes the exact CLI invocation --method skills/get --uri as the recommended workaround, but no test in the repo exercises that invocation against a skill that was skipped for budget reasons, so nothing guards against the flag name, method name, or behavior drifting out of sync with the message that recommends it.

Suggested fix: add a test that simulates hitting the catalog budget, then runs (or simulates running) --method skills/get --uri <skipped-skill-uri> and asserts it returns a real verdict for that skill, so the escape hatch the message advertises is proven to round-trip.

Logs, errors, or screenshots

No response

Already prototyped a fix?

No response

Before you submit

• I searched existing issues and this is not a duplicate.
• This is not a security vulnerability report (those go through the private advisory process).

Start in core/mcp/skillsVerification.ts at the catalog-budget message and inspect its test file plus existing skills verification tests. Add coverage that reaches the budget skip, follows the suggested --method skills/get --uri invocation for the skipped skill, and asserts a real verdict; run the relevant test suite to confirm the escape hatch remains aligned with the message.