A code-analysis server learns which project folder to scan by asking the client for its roots. Now that revision 2026-07-28 has deprecated roots, how should the server get this information?
Select an answer to reveal the explanation.
Short Explanation
Instead of asking the client where to look, you let someone tell you directly: a tool argument, a resource URI, or the server's own config. Snooping the whole home directory is overreach, and servers don't send requests over listen streams anymore.
Full Explanation
Revision 2026-07-28 deprecates roots under SEP-2577, and the deprecated features registry gives the migration path: pass directories or files through tool parameters, resource URIs or server configuration. Each of these makes the scope explicit in data the host or user controls, which also suits the stateless model in which every request carries what it needs. The local server security guidance makes the same point from the security side, recommending that filesystem servers be given a specific project directory through configuration or tool parameters rather than a home directory. clientInfo carries only the client's self-reported name and version for display and debugging; it has no field for directories and should not drive server behavior. Scanning the whole home directory grants the server far broader access than its job requires, which the guidance calls overreach and which exposes credentials stored on disk. Servers in 2026-07-28 never send JSON-RPC requests; server-to-client needs are carried inside an InputRequiredResult, and a subscriptions/listen stream carries only change notifications the client opted into. Exam caveat: roots were always informational and never enforced access, so moving to explicit parameters does not remove the need for isolation. Operational check: confirm the server rejects calls without an explicit folder argument or configured path and never falls back to scanning broader locations.