feat: XtraMCP ToolResult

[4ndrelim]

This PR improves on the ToolResult format from the XtraMCP backend to PaperDebugger's backend to support various downstream use cases. Notably, now we support various branching logic based on the tool. Specialised tools that has been formatted by XtraMCP backend will bypass MCP client reformatting (but will still be sent to the LLM client as part of conversation history and context).

With this new result format alongside XtraMCP's LaTeXParser, we significantly reduce error rates across tool calls.

The changes are as follow:

1. Support v2 integration for XtraMCP and disable v1 usage [1] [2]
2. Improve handling of JSONRPC format and more structured XtraMCP tool result [1] [2]

• Note: We will avoid bloating the existing and a separate chore task will be done to fully deprecate v1 and rename for consistency

3. Branching logic in toolcall_v2.go. This is where we use display_mode to determine whether MCP client should re-interpret the tool results or simply store as context in conv. history [1]
4. Improve frontend display for XtraMCP tool cards. Better UI and markdown rendering. Frontend payload has also been modified to support more functionalities and display of relevant info to the user [1].

---

Note

Introduces XtraMCP ToolResult integration in v2 and updates frontend rendering to handle structured tool outputs.

• Backend: enables XtraMCP v2 dynamic tool loading; adds xtramcp_toolresult parsing with error/verbatim/interpret branches in toolcall_v2.go, separating LLM context vs frontend payload and truncating overly long content; unwraps JSON-RPC from SSE responses in xtramcp helper and uses inner ToolResult in tool_v2.go; disables v1 loader path.
• Frontend: replaces legacy JSONRPC cards with XtraMCP-specific components (review_paper, search_relevant_papers, online_search_papers, verify_citations) and a generic card; routes via isXtraMcpTool; improves markdown header semantics and simplifies tool title styles.

^{Written by Cursor Bugbot for commit 1f6f4f2. This will update automatically on new commits. Configure here.}

[Copilot]

Pull request overview

This PR enhances the XtraMCP ToolResult format to support better integration between the XtraMCP backend and PaperDebugger's frontend, introducing display mode-based branching logic and security context injection for authenticated tool calls.

Key Changes:

• Implemented security context injection for XtraMCP tools requiring user/project authentication, filtering sensitive parameters from LLM visibility
• Added display mode branching logic (verbatim vs interpret) to control how tool results are displayed in the frontend and processed by the LLM
• Migrated from generic JSONRPC components to specialized XtraMCP tool cards with enhanced UI features including collapsible metadata and markdown rendering

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
webapp/_webapp/src/index.css	Removed tool-specific CSS class selector to use generic tool-card-title styling
webapp/_webapp/src/components/message-entry-container/tools/xtramcp/xtramcp-generic-card.tsx	New generic XtraMCP tool card component with support for verbatim/interpret modes and metadata display
webapp/_webapp/src/components/message-entry-container/tools/xtramcp/verify-citations.tsx	Specialized tool card for citation verification with custom metadata rendering
webapp/_webapp/src/components/message-entry-container/tools/xtramcp/utils/common.tsx	Shared utilities for XtraMCP tool result parsing and validation
webapp/_webapp/src/components/message-entry-container/tools/xtramcp/search-relevant-papers.tsx	Specialized card for paper search with query and timing metadata
webapp/_webapp/src/components/message-entry-container/tools/xtramcp/review-paper.tsx	Specialized card for paper review with venue and section metadata
webapp/_webapp/src/components/message-entry-container/tools/xtramcp/online-search-papers.tsx	Specialized card for online paper search with query metadata
webapp/_webapp/src/components/message-entry-container/tools/utils/common.tsx	Removed legacy JSONRPC parsing utilities
webapp/_webapp/src/components/message-entry-container/tools/unknown-jsonrpc.tsx	Removed obsolete JSONRPC component
webapp/_webapp/src/components/message-entry-container/tools/tools.tsx	Updated tool routing to use specialized XtraMCP components based on tool name
webapp/_webapp/src/components/message-entry-container/tools/review-paper.tsx	Removed old review-paper component in favor of XtraMCP version
webapp/_webapp/src/components/message-entry-container/tools/jsonrpc.tsx	Removed generic JSONRPC component
webapp/_webapp/src/components/message-entry-container/tools/general.tsx	Removed tool-specific CSS class from title element
webapp/_webapp/src/components/markdown.tsx	Changed heading elements from div to proper semantic HTML (h1, h2, h3)
internal/services/toolkit/tools/xtramcp/tool_v2.go	Added security context injection, schema filtering, and requiresInjection flag
internal/services/toolkit/tools/xtramcp/tool.go	Added security context injection for v1 client (parallel to v2 changes)
internal/services/toolkit/tools/xtramcp/schema_filter.go	New utility to filter security parameters from tool schemas shown to LLM
internal/services/toolkit/tools/xtramcp/loader_v2.go	Added detection logic for tools requiring security injection
internal/services/toolkit/tools/xtramcp/loader.go	Added detection logic for v1 loader (parallel to v2 changes)
internal/services/toolkit/tools/xtramcp/helper.go	Added JSON-RPC unwrapping and MCP result extraction logic
internal/services/toolkit/handler/xtramcp_toolresult.go	New XtraMCP ToolResult parser with support for display modes and metadata
internal/services/toolkit/handler/toolcall_v2.go	Implemented branching logic for XtraMCP results based on display_mode
internal/services/toolkit/client/utils_v2.go	Enabled XtraMCP tool loading for v2 client
internal/services/toolkit/client/utils.go	Disabled v1 XtraMCP integration (commented out)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cursor]

This PR is being reviewed by Cursor Bugbot

Details

You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Duplicate CSS rule overrides all tool card styling

Medium Severity

The change from .tool-card-title.tool-card-jsonrpc to just .tool-card-title creates a duplicate CSS rule. There's already a .tool-card-title rule at lines 104-106 with font-semibold and text-primary-700. The new duplicate rule at lines 108-110 overrides these with font-medium and text-gray-500 for ALL tool card titles, not just the former JSON-RPC tools. This applies less prominent styling universally when the original styling was meant for regular tool cards and the gray/lighter styling was only for JSON-RPC tools.