feat(server): first-class registerResource / registerPrompt + docs

[harijoe]

Summary

• Adds first-class, chainable registerResource / registerPrompt config-object APIs on McpServer, consistent with registerTool (dual-signature: config-object overloads return this; SDK positional overloads kept for internal view use).
• registerResource supports static uri and dynamic template (with list/complete completions); guard rail throws on the reserved ui://views/ namespace.
• registerPrompt supports argsSchema with completable() argument completions.
• Exposes MCP's other two server primitives (resources, prompts) that were previously usable only via the inherited SDK methods — undiscoverable, non-chaining, positional.

Docs

• New guides: build/resources, build/prompts (each with a Completions section and the list_changed stateless-transport caveat).
• New API reference: register-resource, register-prompt; method blurbs added to mcp-server; nav wired in docs.json.
• chatgpt-app-builder skill: concept note for resources/prompts.

Scope

• No TTools-style type-registry accumulation for resources/prompts (deliberate cut — nothing web-side consumes those types yet).
• Source @see links repointed from the non-existent /fundamentals/* to /build/*.

Tests

register-resource-prompt.test.ts (chaining, e2e read + getPrompt, namespace-guard throw) and .test-d.ts (chainable return type, typed template variables + prompt args). Full core suite green (313), build + lint pass.

[greptile-apps]

Greptile Summary

This PR adds first-class resource and prompt registration APIs. The main changes are:

• Chainable config-object overloads for registerResource and registerPrompt.
• Public ResourceConfig and PromptConfig type exports.
• A reserved ui://views/ guard for config-object resource registrations.
• Runtime and type tests for chaining, prompt args, template variables, and resource reads.
• New docs for resources, prompts, and API reference navigation.

Confidence Score: 4/5

The resource registration path needs a guard fix before merging.

• Config-object resource and prompt registration follows the expected SDK forwarding shape.
• The new namespace guard does not cover the public positional resource overload.
• A caller can still register a resource under ui://views/ and collide with internal view resources.

packages/core/src/server/server.ts

Security Review

The reserved view-resource namespace can still be registered through the public positional registerResource overload, bypassing the new guard.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
packages/core/src/server/server.ts:1391-1392
**Reserved Namespace Bypass**

When callers use the still-public positional overload, this branch forwards `ui://views/` resources directly to the SDK and skips the new guard. A call like `registerResource("sneaky", "ui://views/ext-apps/x.html", {}, cb)` can register inside the reserved view namespace and collide with Skybridge's internal HTML resources.

_{Reviews (1): Last reviewed commit: "feat(server): first-class registerResour..." | Re-trigger Greptile}

[greptile-apps]

Reserved Namespace Bypass

When callers use the still-public positional overload, this branch forwards ui://views/ resources directly to the SDK and skips the new guard. A call like registerResource("sneaky", "ui://views/ext-apps/x.html", {}, cb) can register inside the reserved view namespace and collide with Skybridge's internal HTML resources.

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/core/src/server/server.ts
Line: 1391-1392

Comment:
**Reserved Namespace Bypass**

When callers use the still-public positional overload, this branch forwards `ui://views/` resources directly to the SDK and skips the new guard. A call like `registerResource("sneaky", "ui://views/ext-apps/x.html", {}, cb)` can register inside the reserved view namespace and collide with Skybridge's internal HTML resources.

How can I resolve this? If you propose a fix, please make it concise.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
skybridge-staging	🟢 Ready	View Preview	Jul 8, 2026, 1:55 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.