GitHub Copilot CLI fired nine tools/list calls at one MCP server in forty seconds

A real tools/list is rebuilt on every call. The version in this walkthrough queries a service registry, filters the tool set through RBAC, assembles input schemas from config and applies feature flags. The author counts that as one or more backend round-trips per call ^[7]. Nine of those in about forty seconds works out to one discovery build roughly every 4.4 seconds ^[17]. This is planner behaviour: a ReAct-style agent re-checks the available tools during a multi-step task ^[22]. Under recursive planning loops across many agents, the author calls the discovery endpoint a self-inflicted DoS risk for the databases behind it ^[8].

The code's default TTL is 5 * 60 * 1000 milliseconds ^[9], which is 300 seconds ^[16]. That window is 7.5 times the length of the session that produced the burst, so a client honouring the hint would have fetched once and reused the result eight times ^[18]. For that saving to transfer, the cached list has to survive whatever the client does between turns. A client that holds the tool list as per-session state pays for a fresh build every time it re-initializes, regardless of the TTL. The same session also produced repeated re-initializes ^[6].

cacheScope decides who may hold the copy. The spec defines two values. "public" means the result is identical for everyone, so a shared proxy may keep one copy; "private" means it varies per authorization context and must never be shared across callers ^[3]. A server that filters its tool list through RBAC cannot honestly advertise public, because that list varies by caller ^[21]. The server's in-process cache uses the same value as its key, "*" for public and "client:{client_id}" for private ^[12].

The values go out twice. One copy rides inside the JSON-RPC result; the other is a Cache-Control header for gateways that only read headers, with max-age computed as ttl_ms // 1000, or 300 at the default ^[10][19]. A client implementing CacheableResult reads the top level ^[4]. The author flags the JSON-RPC half as non-conforming, since the server groups it under _meta.cache while the spec puts ttlMs and cacheScope at the top level of the result ^[11].

"I can't trust the caller to honor ttlMs", the author wrote ^[13]. Under the default private scope, the number of expensive builds per five-minute window equals the number of distinct client_ids that call in ^[23]. The published excerpt stops in the middle of the cache class and does not report what any client did with the emitted fields ^[20], so the measurement on the record predates them.