@ai-sdk/mcp 2.0.0-beta.33 → 2.0.0-beta.34

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @ai-sdk/mcp
 
+## 2.0.0-beta.34
+
+### Patch Changes
+
+- 93afb28: feat(mcp): expose server instructions to be accessible through client
+- 9b0bc8a: fix(mcp): prevent prototype pollution by using secureJsonParse
+- Updated dependencies [785fe16]
+- Updated dependencies [67df0a0]
+- Updated dependencies [befb78c]
+- Updated dependencies [0458559]
+- Updated dependencies [5852c0a]
+- Updated dependencies [fc92055]
+  - @ai-sdk/provider-utils@5.0.0-beta.27
+
 ## 2.0.0-beta.33
 
 ### Patch Changes

package/dist/index.d.ts

@@ -490,6 +490,15 @@ interface MCPClient {
      * @see https://modelcontextprotocol.io/specification/2025-11-25/schema#implementation
      */
     readonly serverInfo: Configuration;
+    /**
+     * Optional instructions provided by the server during the initialize handshake.
+     *
+     * These describe how to use the server and its features, and can be used by clients
+     * to improve LLM interactions (e.g. by including them in the system prompt).
+     *
+     * @see https://modelcontextprotocol.io/specification/2025-11-25/schema#initializeresult
+     */
+    readonly instructions?: string;
     tools<TOOL_SCHEMAS extends ToolSchemas = 'automatic'>(options?: {
         schemas?: TOOL_SCHEMAS;
     }): Promise<McpToolSet<TOOL_SCHEMAS>>;

package/dist/index.js

@@ -40,6 +40,7 @@ import {
 } from "@ai-sdk/provider-utils";
 
 // src/tool/json-rpc-message.ts
+import { parseJSON } from "@ai-sdk/provider-utils";
 import { z as z2 } from "zod/v4";
 
 // src/tool/types.ts
@@ -280,6 +281,9 @@ var JSONRPCMessageSchema = z2.union([
   JSONRPCResponseSchema,
   JSONRPCErrorSchema
 ]);
+async function parseJSONRPCMessage(text) {
+  return JSONRPCMessageSchema.parse(await parseJSON({ text }));
+}
 
 // src/version.ts
 var VERSION = typeof __PACKAGE_VERSION__ !== "undefined" ? __PACKAGE_VERSION__ : "0.0.0-test";
@@ -464,6 +468,7 @@ function checkResourceAllowed({
 }
 
 // src/tool/oauth.ts
+import { parseJSON as parseJSON2 } from "@ai-sdk/provider-utils";
 var UnauthorizedError = class extends Error {
   constructor(message = "Unauthorized") {
     super(message);
@@ -745,7 +750,9 @@ async function parseErrorResponse(input) {
   const statusCode = input instanceof Response ? input.status : void 0;
   const body = input instanceof Response ? await input.text() : input;
   try {
-    const result = OAuthErrorResponseSchema.parse(JSON.parse(body));
+    const result = OAuthErrorResponseSchema.parse(
+      await parseJSON2({ text: body })
+    );
     const { error, error_description, error_uri } = result;
     const errorClass = OAUTH_ERRORS[error] || ServerError;
     return new errorClass({
@@ -1157,9 +1164,7 @@ var SseMCPTransport = class {
                   resolve();
                 } else if (event === "message") {
                   try {
-                    const message = JSONRPCMessageSchema.parse(
-                      JSON.parse(data)
-                    );
+                    const message = await parseJSONRPCMessage(data);
                     (_a4 = this.onmessage) == null ? void 0 : _a4.call(this, message);
                   } catch (error) {
                     const e = new MCPClientError({
@@ -1418,7 +1423,7 @@ var HttpMCPTransport = class {
                 const { event, data } = value;
                 if (event === "message") {
                   try {
-                    const msg = JSONRPCMessageSchema.parse(JSON.parse(data));
+                    const msg = await parseJSONRPCMessage(data);
                     (_a4 = this.onmessage) == null ? void 0 : _a4.call(this, msg);
                   } catch (error2) {
                     const e = new MCPClientError({
@@ -1545,7 +1550,7 @@ var HttpMCPTransport = class {
             }
             if (event === "message") {
               try {
-                const msg = JSONRPCMessageSchema.parse(JSON.parse(data));
+                const msg = await parseJSONRPCMessage(data);
                 (_a4 = this.onmessage) == null ? void 0 : _a4.call(this, msg);
               } catch (error) {
                 const e = new MCPClientError({
@@ -1676,6 +1681,9 @@ var DefaultMCPClient = class {
   get serverInfo() {
     return this._serverInfo;
   }
+  get instructions() {
+    return this._serverInstructions;
+  }
   async init() {
     try {
       await this.transport.start();
@@ -1703,6 +1711,7 @@ var DefaultMCPClient = class {
       }
       this.serverCapabilities = result.capabilities;
       this._serverInfo = result.serverInfo;
+      this._serverInstructions = result.instructions;
       await this.notification({
         method: "notifications/initialized"
       });