docs(schema): adopt MCP's icon fetch rules

agent-client-protocol-schema/src/v2/content.rs

@@ -745,7 +745,9 @@ impl ResourceLink {
 #[serde(rename_all = "camelCase")]
 #[non_exhaustive]
 pub struct Icon {
-    /// A standard URI pointing to an icon resource.
+    /// A standard URI pointing to an icon resource. MUST be an `https:` or `data:` URI;
+    /// Clients reject other schemes, fetch without credentials, and do not follow
+    /// scheme- or origin-changing redirects.
     #[cfg_attr(feature = "schemars", schemars(url))]
     pub src: String,
     /// Optional MIME type override if the source MIME type is missing or generic.

docs/protocol/v2/draft/schema.mdx

@@ -4466,7 +4466,9 @@ Omitted and `null` are equivalent and mean no sizes are specified.
 
 </ResponseField>
 <ResponseField name="src" type={"string"} required>
-  A standard URI pointing to an icon resource.
+  A standard URI pointing to an icon resource. MUST be an `https:` or `data:` URI;
+Clients reject other schemes, fetch without credentials, and do not follow
+scheme- or origin-changing redirects.
 
     - Format: `uri`
 

docs/protocol/v2/draft/security.mdx

@@ -32,9 +32,10 @@ This applies to all Agent-authored display text, including messages, thoughts, t
 This applies to `uri` on images, resource links, and embedded resources, to icon `src`, and to URLs in Markdown.
 
 - Clients **SHOULD** render images from `data` and **SHOULD NOT** fetch Agent-supplied remote URIs without user action. A request can leak data through its URL.
+- Icon `src` is the only URI a Client may fetch without user action. For icons, as in MCP, Clients **MUST** accept only `https:` and `data:` URIs and reject other schemes, including `file:`. They **MUST** fetch without credentials, **MUST NOT** follow redirects that change the scheme or origin, and **MUST** apply these checks to every redirect hop. Clients that display icons **MUST** support PNG and JPEG.
 - Automatic fetches **SHOULD** use only `https:` or `data:` URIs, **SHOULD NOT** carry credentials, **SHOULD** refuse loopback and private-network targets, and **SHOULD** bound the response size.
 - Clients **SHOULD NOT** run scripts in SVG images from Agent content.
-- Clients **SHOULD NOT** read a `file:` URI from Agent content outside the session's [root set](/protocol/v2/draft/session-setup#workspace-root-security) without user action.
+- Apart from icons, which never use `file:`, Clients **SHOULD NOT** read a `file:` URI from Agent content outside the session's [root set](/protocol/v2/draft/session-setup#workspace-root-security) without user action.
 - Agents **SHOULD** apply the root set and these fetch rules to URIs in prompts.
 
 ## Credentials

docs/protocol/v2/schema.mdx

@@ -3996,7 +3996,9 @@ Omitted and `null` are equivalent and mean no sizes are specified.
 
 </ResponseField>
 <ResponseField name="src" type={"string"} required>
-  A standard URI pointing to an icon resource.
+  A standard URI pointing to an icon resource. MUST be an `https:` or `data:` URI;
+Clients reject other schemes, fetch without credentials, and do not follow
+scheme- or origin-changing redirects.
 
     - Format: `uri`
 

docs/protocol/v2/security.mdx

@@ -32,9 +32,10 @@ This applies to all Agent-authored display text, including messages, thoughts, t
 This applies to `uri` on images, resource links, and embedded resources, to icon `src`, and to URLs in Markdown.
 
 - Clients **SHOULD** render images from `data` and **SHOULD NOT** fetch Agent-supplied remote URIs without user action. A request can leak data through its URL.
+- Icon `src` is the only URI a Client may fetch without user action. For icons, as in MCP, Clients **MUST** accept only `https:` and `data:` URIs and reject other schemes, including `file:`. They **MUST** fetch without credentials, **MUST NOT** follow redirects that change the scheme or origin, and **MUST** apply these checks to every redirect hop. Clients that display icons **MUST** support PNG and JPEG.
 - Automatic fetches **SHOULD** use only `https:` or `data:` URIs, **SHOULD NOT** carry credentials, **SHOULD** refuse loopback and private-network targets, and **SHOULD** bound the response size.
 - Clients **SHOULD NOT** run scripts in SVG images from Agent content.
-- Clients **SHOULD NOT** read a `file:` URI from Agent content outside the session's [root set](/protocol/v2/session-setup#workspace-root-security) without user action.
+- Apart from icons, which never use `file:`, Clients **SHOULD NOT** read a `file:` URI from Agent content outside the session's [root set](/protocol/v2/session-setup#workspace-root-security) without user action.
 - Agents **SHOULD** apply the root set and these fetch rules to URIs in prompts.
 
 ## Credentials

schema/v2/schema.json

@@ -930,7 +930,7 @@
       "type": "object",
       "properties": {
         "src": {
-          "description": "A standard URI pointing to an icon resource.",
+          "description": "A standard URI pointing to an icon resource. MUST be an `https:` or `data:` URI;\nClients reject other schemes, fetch without credentials, and do not follow\nscheme- or origin-changing redirects.",
           "type": "string",
           "format": "uri"
         },

schema/v2/schema.unstable.json

@@ -939,7 +939,7 @@
       "type": "object",
       "properties": {
         "src": {
-          "description": "A standard URI pointing to an icon resource.",
+          "description": "A standard URI pointing to an icon resource. MUST be an `https:` or `data:` URI;\nClients reject other schemes, fetch without credentials, and do not follow\nscheme- or origin-changing redirects.",
           "type": "string",
           "format": "uri"
         },