@ai-sdk/mcp 2.0.12 → 2.0.14

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @ai-sdk/mcp
 
+## 2.0.14
+
+### Patch Changes
+
+- 48e7e78: Harden MCP Apps handling of server-supplied resource metadata and the host/iframe bridge:
+
+  - Runtime-validate `_meta.ui` and drop malformed or non-string fields.
+  - Gate iframe permissions deny-by-default via a new `sandbox.allowedPermissions` allowlist.
+  - Derive a concrete `postMessage` target origin and validate inbound message origins.
+  - Validate inbound bridge params: limit `resources/read` to `ui://` resources and allow only `https`/`http`/`mailto` in `ui/open-link`.
+  - Add `fingerprintMCPAppResource` / `detectMCPAppResourceDrift` for pinning and comparing app resources.
+
+## 2.0.13
+
+### Patch Changes
+
+- Updated dependencies [31c7be8]
+  - @ai-sdk/provider-utils@5.0.10
+
 ## 2.0.12
 
 ### Patch Changes

package/dist/index.d.ts

@@ -762,4 +762,19 @@ declare function readMCPAppResource({ client, uri, options, }: {
     options?: RequestOptions;
 }): Promise<MCPAppResource>;
 
-export { type CallToolResult, type CompleteRequestParams, type CompleteResult, type Configuration, type ElicitResult, ElicitResultSchema, type ElicitationRequest, ElicitationRequestSchema, type InitializeResult, type JSONRPCError, type JSONRPCMessage, type JSONRPCNotification, type JSONRPCRequest, type JSONRPCResponse, type ListToolsResult, type MCPAppResource, type MCPAppResourceCSP, type MCPAppResourceMeta, type MCPClient, type ClientCapabilities as MCPClientCapabilities, type MCPClientConfig, type MCPTransport, MCP_APP_MIME_TYPE, type McpProviderMetadata, type OAuthAuthorizationServerInformation, type OAuthClientInformation, type OAuthClientMetadata, type OAuthClientProvider, type OAuthTokens, UnauthorizedError, auth, createMCPClient, type MCPClient as experimental_MCPClient, type ClientCapabilities as experimental_MCPClientCapabilities, type MCPClientConfig as experimental_MCPClientConfig, createMCPClient as experimental_createMCPClient, mcpAppClientCapabilities, readMCPAppResource, splitMCPAppTools, validateJSONRPCMessage };
+/**
+ * Stable SHA-256 digest (base64url) over an MCP App resource's `html`, `csp`,
+ * and `permissions`.
+ *
+ * Capture a baseline on first load and compare later reads with
+ * {@link detectMCPAppResourceDrift} to detect a changed resource. Baseline
+ * storage and the response are the host's concern, mirroring `fingerprintTools`.
+ */
+declare function fingerprintMCPAppResource(resource: MCPAppResource): Promise<string>;
+/**
+ * Compares two fingerprints from {@link fingerprintMCPAppResource}. Returns
+ * `true` when the current resource differs from its baseline.
+ */
+declare function detectMCPAppResourceDrift(current: string, baseline: string): boolean;
+
+export { type CallToolResult, type CompleteRequestParams, type CompleteResult, type Configuration, type ElicitResult, ElicitResultSchema, type ElicitationRequest, ElicitationRequestSchema, type InitializeResult, type JSONRPCError, type JSONRPCMessage, type JSONRPCNotification, type JSONRPCRequest, type JSONRPCResponse, type ListToolsResult, type MCPAppResource, type MCPAppResourceCSP, type MCPAppResourceMeta, type MCPClient, type ClientCapabilities as MCPClientCapabilities, type MCPClientConfig, type MCPTransport, MCP_APP_MIME_TYPE, type McpProviderMetadata, type OAuthAuthorizationServerInformation, type OAuthClientInformation, type OAuthClientMetadata, type OAuthClientProvider, type OAuthTokens, UnauthorizedError, auth, createMCPClient, detectMCPAppResourceDrift, type MCPClient as experimental_MCPClient, type ClientCapabilities as experimental_MCPClientCapabilities, type MCPClientConfig as experimental_MCPClientConfig, createMCPClient as experimental_createMCPClient, fingerprintMCPAppResource, mcpAppClientCapabilities, readMCPAppResource, splitMCPAppTools, validateJSONRPCMessage };

package/dist/index.js

@@ -1971,6 +1971,7 @@ function isCustomMcpTransport(transport) {
 // src/tool/mcp-apps.ts
 import { isJSONObject } from "@ai-sdk/provider";
 import { convertBase64ToUint8Array } from "@ai-sdk/provider-utils";
+import * as z4 from "zod/v4";
 var MCP_APP_EXTENSION_NAME = "io.modelcontextprotocol/ui";
 var MCP_APP_MIME_TYPE = "text/html;profile=mcp-app";
 var MCP_APP_LEGACY_RESOURCE_URI_META_KEY = "ui/resourceUri";
@@ -1985,11 +1986,25 @@ function getToolUiMeta(meta) {
   const uiMeta = meta == null ? void 0 : meta.ui;
   return isJSONObject(uiMeta) ? uiMeta : void 0;
 }
+var optionalStringArray = z4.array(z4.unknown()).transform((items) => items.filter((v) => typeof v === "string")).optional().catch(void 0);
+var MCPAppResourceCSPSchema = z4.looseObject({
+  connectDomains: optionalStringArray,
+  resourceDomains: optionalStringArray,
+  frameDomains: optionalStringArray
+});
+var MCPAppResourceMetaSchema = z4.looseObject({
+  prefersBorder: z4.boolean().optional().catch(void 0),
+  csp: MCPAppResourceCSPSchema.optional().catch(void 0),
+  permissions: z4.record(z4.string(), z4.unknown()).optional().catch(void 0)
+});
 function getResourceUiMeta(meta) {
   const resourceMeta = isJSONObject(meta) ? meta : void 0;
   const rawUiMeta = resourceMeta == null ? void 0 : resourceMeta.ui;
-  const uiMeta = isJSONObject(rawUiMeta) ? rawUiMeta : void 0;
-  return uiMeta;
+  if (!isJSONObject(rawUiMeta)) {
+    return void 0;
+  }
+  const parsed = MCPAppResourceMetaSchema.safeParse(rawUiMeta);
+  return parsed.success ? parsed.data : void 0;
 }
 function parseVisibility(value) {
   return Array.isArray(value) ? value.filter(
@@ -2790,6 +2805,41 @@ var DefaultMCPClient = class {
     );
   }
 };
+
+// src/tool/mcp-app-fingerprint.ts
+import { convertUint8ArrayToBase64 } from "@ai-sdk/provider-utils";
+var encoder = new TextEncoder();
+function canonicalJSON(value) {
+  if (value == null || typeof value !== "object") {
+    return JSON.stringify(value != null ? value : null);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJSON).join(",")}]`;
+  }
+  const record2 = value;
+  const entries = Object.keys(record2).sort().map((k) => `${JSON.stringify(k)}:${canonicalJSON(record2[k])}`);
+  return `{${entries.join(",")}}`;
+}
+function toBase64url(bytes) {
+  return convertUint8ArrayToBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+async function fingerprintMCPAppResource(resource) {
+  var _a3, _b3, _c, _d;
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    encoder.encode(
+      canonicalJSON({
+        html: resource.html,
+        csp: (_b3 = (_a3 = resource.meta) == null ? void 0 : _a3.csp) != null ? _b3 : null,
+        permissions: (_d = (_c = resource.meta) == null ? void 0 : _c.permissions) != null ? _d : null
+      })
+    )
+  );
+  return toBase64url(new Uint8Array(digest));
+}
+function detectMCPAppResourceDrift(current, baseline) {
+  return current !== baseline;
+}
 export {
   ElicitResultSchema,
   ElicitationRequestSchema,
@@ -2797,7 +2847,9 @@ export {
   UnauthorizedError,
   auth,
   createMCPClient,
+  detectMCPAppResourceDrift,
   createMCPClient as experimental_createMCPClient,
+  fingerprintMCPAppResource,
   mcpAppClientCapabilities,
   readMCPAppResource,
   splitMCPAppTools,