@cloudgrid-io/mcp 0.21.21 → 0.21.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.21.21",
+  "version": "0.21.22",
   "description": "MCP access to CloudGrid — the live runtime environment where the user's apps run WITH the infrastructure they need out of the box: managed MongoDB, Redis (cache/queues/pub-sub), a pgvector store, persistent disk, and built-in AI with no API keys, in any language or stack, no Docker or Kubernetes to manage. Brainstorm, build, plug, and improve apps, games, dashboards, and tools; instant single-page publishes and full runtime-app deploys with a live URL — for developers and non-technical users. Three editions: local stdio (full toolset), hosted web (light, CLI-free), and a public docs-search server.",
   "type": "module",
   "bin": {
@@ -52,6 +52,7 @@
     "test:oauth-gate": "node test/oauth-gate.test.mjs",
     "test:index-favicon": "node test/index-favicon.test.mjs",
     "test:auth": "node test/auth.test.mjs",
+    "test:tools-list-contract": "node test/tools-list-contract.test.mjs",
     "test:auth-strictness": "node test/auth-strictness.test.mjs",
     "test:win-cli": "node test/windows-cli-resolution.test.mjs",
     "test:electron-env": "node test/electron-spawn-env.test.mjs",
@@ -92,7 +93,7 @@
     "@modelcontextprotocol/sdk": "^1.32.1",
     "express": "^5.3.0",
     "fflate": "^0.8.3",
-    "undici": "^8.11.2",
+    "undici": "^8.12.2",
     "zod": "^3.23.0"
   },
   "devDependencies": {

package/src/tools/register.js

@@ -84,6 +84,20 @@ const AUTH_ASK_SIGNED_OUT =
   "(assistant: call grid_login now; after they finish, retry grid_plug. Do not offer " +
   "any sign-in-free path. Stop and wait for the sign-in to complete.)";
 
+// ── Strict tool inputs (#400) ──────────────────────────────────────────────
+// Every tool's input is a z.strictObject, so `tools/list` advertises
+// `additionalProperties: false` under zod 3 AND zod 4. The SDK renders a tool
+// input in zod 4's "input" mode, where a plain z.object (which strips unknown
+// keys rather than rejecting them) gets no `additionalProperties` at all; only a
+// strict object keeps `false`. A raw shape is wrapped here; an empty shape is
+// left alone (the SDK advertises it as `{type: "object", properties: {}}`, as
+// before). Objects nested inside an input use z.strictObject at their own site.
+// test/tools-list-contract.test.mjs holds the emitted contract.
+export function strictInput(schema) {
+  if (!schema || typeof schema !== "object" || schema._def || schema._zod) return schema;
+  return Object.keys(schema).length > 0 ? z.strictObject(schema) : schema;
+}
+
 // ── Registration ───────────────────────────────────────────────────────────────
 // Registers the tools onto `server`. ctx.edition decides whether the CLI-wrapping
 // tools are included (they need a local machine).
@@ -122,11 +136,11 @@ export function registerTools(server, ctx) {
   // grid_copy_app, grid_claim_anonymous_deploy, grid_download_source,
   // grid_fetch, grid_logs) are gone rather than advertised as redirects.
   const reg = (name, config, handler) => {
-    server.registerTool(name, config, withCapture(name, handler));
+    server.registerTool(name, { ...config, inputSchema: strictInput(config.inputSchema) }, withCapture(name, handler));
   };
 
   const regTool = (name, title, description, schema, annotations, handler) => {
-    server.registerTool(name, { title, description, inputSchema: schema, annotations }, withCapture(name, handler));
+    server.registerTool(name, { title, description, inputSchema: strictInput(schema), annotations }, withCapture(name, handler));
   };
 
   // ── Widget resources (web edition, ChatGPT Apps SDK) ──────────────────────
@@ -384,7 +398,7 @@ export function registerTools(server, ctx) {
             "over the archive's files (generate the page, let the zip supply the images).",
           ),
         }),
-    artifact_files: z.array(z.object({
+    artifact_files: z.array(z.strictObject({
       path: z.string().describe("Repo-relative path, e.g. index.html or services/web/index.js."),
       content: z.string().describe("File content. Base64 when encoding is base64, otherwise UTF-8 text."),
       encoding: z.enum(["utf8", "base64"]).optional().describe("Content encoding. Default utf8."),
@@ -427,7 +441,7 @@ export function registerTools(server, ctx) {
       "the pickup contract, so no `grid` param is needed. target_entity_id and grid+slug take precedence. A " +
       "non-CloudGrid host is ignored (never redirects the write); a URL that does not resolve is treated as a CREATE.",
     ),
-    hints: z.object({
+    hints: z.strictObject({
       kind: z.enum(["inspiration", "app", "agent"]).optional().describe("Force the detected kind; omit to let the server auto-detect."),
       yaml: z.string().optional().describe("An inline cloudgrid.yaml override used as a detection hint."),
     }).optional().describe("Classification hints for the CREATE path (not entity targeting — that's target_entity_id)."),
@@ -1104,7 +1118,7 @@ export function registerTools(server, ctx) {
           .string()
           .describe("Short summary of what failed (required). Do not paste the whole conversation here."),
         context: z
-          .object({
+          .strictObject({
             tool: z.string().optional().describe("The CloudGrid tool that failed, e.g. grid_plug."),
             inputs: z.any().optional().describe("The failing inputs (e.g. the HTML/args). Keep it minimal and do NOT include secrets — a secret embedded in a value here is not redacted."),
             grid: z.string().optional().describe("The grid/org slug involved, if any."),