feat(api): add spec.iconUrl to catalog resources - #604
Open
Charlesthebird wants to merge 2 commits into
Open
Conversation
Agent, MCPServer, Skill, Prompt, and Plugin gain an optional spec.iconUrl — the image a catalog UI shows for the resource. It is a first-class spec field rather than a well-known annotation so the contract is typed, discoverable in the OpenAPI schema, and validated on write. validateIconURL accepts an absolute https:// URL or a path on the serving UI's own origin, and rejects everything else. The value is rendered as an image source, so plain http:// would be blocked as mixed content, javascript:/data: would make the field an injection point, and a scheme-relative //host/path would smuggle an external host past a naive "starts with a slash" check. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Nicholas Bucher <behappy54321@gmail.com>
github-actions
Bot
added
kind/feature
release-note
do-not-merge/kind-invalid
do-not-merge/release-note-invalid
and removed
release-note
labels
Charlesthebird
marked this pull request as ready for review
July 31, 2026 20:05
Charlesthebird
enabled auto-merge
July 31, 2026 20:06
github-actions
Bot
added
release-note
and removed
do-not-merge/kind-invalid
do-not-merge/release-note-invalid
labels
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Motivation: a catalog UI needs somewhere to record the image it shows for a
resource. That was being carried as a well-known annotation, which works but
leaves the contract untyped, invisible in the OpenAPI schema, and unvalidated on
write. A spec field is the right home for it.
What changed: an optional
spec.iconUrlonAgent,MCPServer,Skill,Prompt, andPlugin— all five kinds a catalog lists, so a UI does not haveto read the icon from a different place depending on the kind.
validateIconURLaccepts an absolutehttps://URL or a path on the servingUI's own origin, and rejects everything else. The value is rendered as an image
source, which is what each rejection is about:
http://is blocked as mixed content whenever the UI is served overHTTPS, so it would silently never render
javascript:/data:would make the field an injection point//other-host/pathwould smuggle an external host past anaive "starts with a slash" check
Existing resources are unaffected — the field is optional and omitted from the
serialized spec when empty, so re-applying unchanged intent stays a no-op.
🤖 written by Claude (start)
Change Type
/kind feature
Changelog
Additional Notes
openapi.yamlandui/lib/api/types.gen.tsare regenerated, not hand-edited.Existing resources are unaffected: the field is optional and omitted from the serialized spec when empty, so re-applying unchanged intent stays a no-op.
A downstream consumer wants this to replace an
icon-urlannotation it currently reads; that change is waiting on this landing plus a patch release to bump against.🤖 written by Claude (end)