@j0hanz/filesystem-mcp 1.11.1 → 1.12.0

package/dist/lib/fs-helpers.js

@@ -1,15 +1,66 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
 import * as fsp from 'node:fs/promises';
 import * as path from 'node:path';
 import { isUtf8 } from 'node:buffer';
 import { randomUUID } from 'node:crypto';
-import { Writable } from 'node:stream';
-import { pipeline } from 'node:stream/promises';
 import { BINARY_CHECK_BUFFER_SIZE, KNOWN_BINARY_EXTENSIONS, MAX_TEXT_FILE_SIZE, PARALLEL_CONCURRENCY, } from './constants.js';
 import { ErrorCode, McpError, normalizeUnknownError } from './errors.js';
 import { assertAllowedFileAccess, validateExistingPath } from './paths.js';
 function createAbortError(message = 'Operation aborted') {
     return new DOMException(message, 'AbortError');
 }
+const READ_ONLY_FILE_FLAG = 'r';
 const SHARED_NOOP_SIGNAL = new AbortController().signal;
 function normalizeAbortReason(reason, message) {
     if (reason instanceof Error)
@@ -55,39 +106,22 @@ function getAbortError(signal, message) {
 export function withAbort(promise, signal) {
     if (!signal)
         return promise;
-    assertNotAborted(signal);
+    signal.throwIfAborted();
     return new Promise((resolve, reject) => {
-        let settled = false;
-        const finish = (run) => {
-            if (settled)
-                return;
-            settled = true;
-            signal.removeEventListener('abort', onAbort);
-            run();
-        };
         const onAbort = () => {
-            finish(() => {
-                reject(getAbortError(signal));
-            });
+            reject(getAbortError(signal));
         };
-        signal.addEventListener('abort', onAbort, { once: true });
-        try {
-            signal.throwIfAborted();
-        }
-        catch {
+        if (signal.aborted) {
             onAbort();
             return;
         }
-        promise
-            .then((value) => {
-            finish(() => {
-                resolve(value);
-            });
-        })
-            .catch((error) => {
-            finish(() => {
-                reject(normalizeUnknownError(error));
-            });
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then((value) => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(value);
+        }, (error) => {
+            signal.removeEventListener('abort', onAbort);
+            reject(normalizeUnknownError(error));
         });
     });
 }
@@ -102,12 +136,12 @@ export function createTimedAbortSignal(baseSignal, timeoutMs) {
         };
     }
     if (baseSignal) {
-        return createForwardedSignal(baseSignal);
+        return { signal: baseSignal, cleanup: () => { } };
     }
     if (timeoutSignal) {
         return { signal: timeoutSignal, cleanup: () => { } };
     }
-    return createNoopSignal();
+    return { signal: SHARED_NOOP_SIGNAL, cleanup: () => { } };
 }
 export async function withTimedAbortSignal(baseSignal, timeoutMs, run) {
     const { signal, cleanup } = createTimedAbortSignal(baseSignal, timeoutMs);
@@ -118,12 +152,6 @@ export async function withTimedAbortSignal(baseSignal, timeoutMs, run) {
         cleanup();
     }
 }
-function createNoopSignal() {
-    return { signal: SHARED_NOOP_SIGNAL, cleanup: () => { } };
-}
-function createForwardedSignal(baseSignal) {
-    return { signal: baseSignal, cleanup: () => { } };
-}
 function createParallelAbortError() {
     return createAbortError();
 }
@@ -193,20 +221,8 @@ function hasKnownBinaryExtension(filePath) {
     const ext = path.extname(filePath).toLowerCase();
     return KNOWN_BINARY_EXTENSIONS.has(ext);
 }
-async function withFileHandle(filePath, fn, existingHandle, signal) {
-    if (existingHandle) {
-        return fn(existingHandle);
-    }
-    const effectivePath = await validateExistingPath(filePath, signal);
-    const handle = await withAbort(fsp.open(effectivePath, 'r'), signal);
-    try {
-        return await fn(handle);
-    }
-    finally {
-        await handle.close().catch((error) => {
-            console.error('Failed to close file handle:', error);
-        });
-    }
+async function openReadableFileHandle(filePath, signal) {
+    return withAbort(fsp.open(filePath, READ_ONLY_FILE_FLAG), signal);
 }
 async function readProbe(handle, signal) {
     const buffer = Buffer.alloc(BINARY_CHECK_BUFFER_SIZE);
@@ -222,13 +238,29 @@ function hasUtf16Bom(slice) {
             (slice[0] === 0xfe && slice[1] === 0xff)));
 }
 export async function isProbablyBinary(filePath, existingHandle, signal) {
-    if (hasKnownBinaryExtension(filePath)) {
-        return true;
-    }
-    return withFileHandle(filePath, async (handle) => {
+    const env_1 = { stack: [], error: void 0, hasError: false };
+    try {
+        if (hasKnownBinaryExtension(filePath)) {
+            return true;
+        }
+        if (existingHandle) {
+            const slice = await readProbe(existingHandle, signal);
+            return isBinarySlice(slice);
+        }
+        const effectivePath = await validateExistingPath(filePath, signal);
+        const handle = __addDisposableResource(env_1, await openReadableFileHandle(effectivePath, signal), true);
         const slice = await readProbe(handle, signal);
         return isBinarySlice(slice);
-    }, existingHandle, signal);
+    }
+    catch (e_1) {
+        env_1.error = e_1;
+        env_1.hasError = true;
+    }
+    finally {
+        const result_1 = __disposeResources(env_1);
+        if (result_1)
+            await result_1;
+    }
 }
 function isBinarySlice(slice) {
     if (slice.length === 0)
@@ -316,42 +348,35 @@ const STREAM_CHUNK_SIZE = 64 * 1024;
 function createTooLargeError(bytesRead, maxSize, requestedPath) {
     return new McpError(ErrorCode.E_TOO_LARGE, `File exceeds maximum size (${bytesRead} > ${maxSize}): ${requestedPath}`, requestedPath, { size: bytesRead, maxSize });
 }
-class BufferCollector extends Writable {
-    #chunks = [];
-    #totalSize = 0;
-    #maxSize;
-    #requestedPath;
-    constructor(maxSize, requestedPath) {
-        super({ autoDestroy: true });
-        this.#maxSize = maxSize;
-        this.#requestedPath = requestedPath;
-    }
-    _write(chunk, _encoding, callback) {
-        const buffer = Buffer.isBuffer(chunk)
-            ? chunk
-            : Buffer.from(chunk, _encoding);
-        this.#totalSize += buffer.length;
-        if (this.#totalSize > this.#maxSize) {
-            callback(createTooLargeError(this.#totalSize, this.#maxSize, this.#requestedPath));
-            return;
-        }
-        this.#chunks.push(buffer);
-        callback();
-    }
-    getResult() {
-        return Buffer.concat(this.#chunks, this.#totalSize);
-    }
-}
 async function readFileBufferWithLimit(handle, maxSize, requestedPath, signal) {
     const stream = handle.createReadStream({
         start: 0,
         highWaterMark: STREAM_CHUNK_SIZE,
         autoClose: false,
         emitClose: false,
+        signal,
     });
-    const collector = new BufferCollector(maxSize, requestedPath);
-    await pipeline(stream, collector, { signal });
-    return collector.getResult();
+    const chunks = [];
+    let totalSize = 0;
+    try {
+        for await (const chunk of stream) {
+            const buffer = Buffer.isBuffer(chunk)
+                ? chunk
+                : Buffer.from(chunk);
+            totalSize += buffer.length;
+            if (totalSize > maxSize) {
+                stream.destroy();
+                throw createTooLargeError(totalSize, maxSize, requestedPath);
+            }
+            chunks.push(buffer);
+        }
+    }
+    finally {
+        if (!stream.destroyed) {
+            stream.destroy();
+        }
+    }
+    return Buffer.concat(chunks, totalSize);
 }
 async function headFile(handle, numLines, encoding = 'utf-8', maxBytesRead, signal) {
     assertNotAborted(signal);
@@ -499,15 +524,24 @@ async function assertNotBinary(validPath, filePath, normalized) {
         return;
     throw new McpError(ErrorCode.E_INVALID_INPUT, `Binary file detected: ${filePath}. Refusing to read as text.`, filePath);
 }
-function requireHead(normalized, filePath) {
-    if (normalized.head === undefined) {
-        throw new McpError(ErrorCode.E_INVALID_INPUT, 'Missing head option', filePath);
+function assertSizeWithinLimit(size, maxSize, filePath) {
+    if (size <= maxSize)
+        return;
+    throw new McpError(ErrorCode.E_TOO_LARGE, `File too large: ${size} bytes (max: ${maxSize} bytes). Use head parameter to preview the first N lines.`, filePath, { size, maxSize });
+}
+function requireReadOption(normalized, key, filePath) {
+    const value = normalized[key];
+    if (value !== undefined) {
+        return value;
     }
-    return normalized.head;
+    throw new McpError(ErrorCode.E_INVALID_INPUT, `Missing ${key} option`, filePath);
 }
-function buildHeadResult(validPath, content, truncated, head, linesRead, hasMoreLines) {
+async function executeHeadRead(context) {
+    const head = requireReadOption(context.normalized, 'head', context.filePath);
+    const readOptions = buildReadContentOptions(context.normalized);
+    const { content, truncated, linesRead, hasMoreLines } = await readHeadContent(context.handle, head, readOptions);
     return {
-        path: validPath,
+        path: context.validPath,
         content,
         truncated,
         readMode: 'head',
@@ -516,24 +550,27 @@ function buildHeadResult(validPath, content, truncated, head, linesRead, hasMore
         hasMoreLines,
     };
 }
-function buildRangeResult(validPath, content, truncated, startLine, endLine, linesRead, hasMoreLines) {
-    const result = {
-        path: validPath,
+async function executeRangeRead(context) {
+    const startLine = requireReadOption(context.normalized, 'startLine', context.filePath);
+    const { endLine } = context.normalized;
+    const readOptions = buildReadContentOptions(context.normalized);
+    const { content, truncated, linesRead, hasMoreLines } = await readRangeContent(context.handle, startLine, endLine, readOptions);
+    return {
+        path: context.validPath,
         content,
         truncated,
         readMode: 'range',
         startLine,
+        ...(endLine !== undefined ? { endLine } : {}),
         linesRead,
         hasMoreLines,
     };
-    if (endLine !== undefined) {
-        result.endLine = endLine;
-    }
-    return result;
 }
-function buildFullResult(validPath, content, totalLines) {
+async function executeFullRead(context) {
+    assertSizeWithinLimit(context.stats.size, context.normalized.maxSize, context.filePath);
+    const { content, totalLines } = await readFullContent(context.handle, context.normalized.encoding, context.normalized.maxSize, context.filePath, context.normalized.signal);
     return {
-        path: validPath,
+        path: context.validPath,
         content,
         truncated: false,
         totalLines,
@@ -542,9 +579,12 @@ function buildFullResult(validPath, content, totalLines) {
         hasMoreLines: false,
     };
 }
-function buildTailResult(validPath, content, truncated, tail, linesRead, hasMoreLines) {
+async function executeTailRead(context) {
+    const tail = requireReadOption(context.normalized, 'tail', context.filePath);
+    const readOptions = buildReadContentOptions(context.normalized);
+    const { content, truncated, linesRead, hasMoreLines } = await readTailContent(context.handle, tail, readOptions);
     return {
-        path: validPath,
+        path: context.validPath,
         content,
         truncated,
         readMode: 'tail',
@@ -553,51 +593,15 @@ function buildTailResult(validPath, content, truncated, tail, linesRead, hasMore
         hasMoreLines,
     };
 }
-function assertSizeWithinLimit(size, maxSize, filePath) {
-    if (size <= maxSize)
-        return;
-    throw new McpError(ErrorCode.E_TOO_LARGE, `File too large: ${size} bytes (max: ${maxSize} bytes). Use head parameter to preview the first N lines.`, filePath, { size, maxSize });
-}
-async function readHeadResult(handle, validPath, filePath, normalized) {
-    const head = requireHead(normalized, filePath);
-    const readOptions = buildReadContentOptions(normalized);
-    const { content, truncated, linesRead, hasMoreLines } = await readHeadContent(handle, head, readOptions);
-    return buildHeadResult(validPath, content, truncated, head, linesRead, hasMoreLines);
-}
-async function readRangeResult(handle, validPath, filePath, normalized) {
-    const { startLine, endLine } = normalized;
-    if (startLine === undefined) {
-        throw new McpError(ErrorCode.E_INVALID_INPUT, 'Missing startLine option', filePath);
-    }
-    const readOptions = buildReadContentOptions(normalized);
-    const { content, truncated, linesRead, hasMoreLines } = await readRangeContent(handle, startLine, endLine, readOptions);
-    return buildRangeResult(validPath, content, truncated, startLine, endLine, linesRead, hasMoreLines);
-}
-async function readFullResult(handle, validPath, filePath, stats, normalized) {
-    assertSizeWithinLimit(stats.size, normalized.maxSize, filePath);
-    const { content, totalLines } = await readFullContent(handle, normalized.encoding, normalized.maxSize, filePath, normalized.signal);
-    return buildFullResult(validPath, content, totalLines);
-}
-async function readTailResult(handle, validPath, filePath, normalized) {
-    if (normalized.tail === undefined) {
-        throw new McpError(ErrorCode.E_INVALID_INPUT, 'Missing tail option', filePath);
-    }
-    const readOptions = buildReadContentOptions(normalized);
-    const { content, truncated, linesRead, hasMoreLines } = await readTailContent(handle, normalized.tail, readOptions);
-    return buildTailResult(validPath, content, truncated, normalized.tail, linesRead, hasMoreLines);
-}
-async function readByMode(handle, validPath, filePath, stats, normalized) {
-    const mode = resolveReadMode(normalized);
-    if (mode === 'head') {
-        return readHeadResult(handle, validPath, filePath, normalized);
-    }
-    if (mode === 'tail') {
-        return readTailResult(handle, validPath, filePath, normalized);
-    }
-    if (mode === 'range') {
-        return readRangeResult(handle, validPath, filePath, normalized);
-    }
-    return readFullResult(handle, validPath, filePath, stats, normalized);
+const READ_MODE_HANDLERS = {
+    head: executeHeadRead,
+    range: executeRangeRead,
+    full: executeFullRead,
+    tail: executeTailRead,
+};
+async function readByMode(context) {
+    const mode = resolveReadMode(context.normalized);
+    return READ_MODE_HANDLERS[mode](context);
 }
 function assertFileStats(filePath, stats) {
     if (!stats.isFile()) {
@@ -605,19 +609,32 @@ function assertFileStats(filePath, stats) {
     }
 }
 async function readFileWithStatsInternal(filePath, validPath, stats, normalized) {
-    assertNotAborted(normalized.signal);
-    assertAllowedFileAccess(filePath, validPath);
-    assertFileStats(filePath, stats);
-    if (normalized.skipBinary) {
-        await assertNotBinary(validPath, filePath, normalized);
-    }
-    assertNotAborted(normalized.signal);
-    const handle = await withAbort(fsp.open(validPath, 'r'), normalized.signal);
+    const env_2 = { stack: [], error: void 0, hasError: false };
     try {
-        return await readByMode(handle, validPath, filePath, stats, normalized);
+        assertNotAborted(normalized.signal);
+        assertAllowedFileAccess(filePath, validPath);
+        assertFileStats(filePath, stats);
+        if (normalized.skipBinary) {
+            await assertNotBinary(validPath, filePath, normalized);
+        }
+        assertNotAborted(normalized.signal);
+        const handle = __addDisposableResource(env_2, await openReadableFileHandle(validPath, normalized.signal), true);
+        return await readByMode({
+            handle,
+            validPath,
+            filePath,
+            stats,
+            normalized,
+        });
+    }
+    catch (e_2) {
+        env_2.error = e_2;
+        env_2.hasError = true;
     }
     finally {
-        await handle.close();
+        const result_2 = __disposeResources(env_2);
+        if (result_2)
+            await result_2;
     }
 }
 export async function readFileWithStats(filePath, validPath, stats, options = {}) {
@@ -636,7 +653,7 @@ export async function atomicWriteFile(filePath, content, options = {}) {
     const tempPath = `${filePath}.${randomUUID()}.tmp`;
     try {
         assertNotAborted(signal);
-        await withAbort(fsp.writeFile(tempPath, content, { encoding, signal }), signal);
+        await fsp.writeFile(tempPath, content, { encoding, signal });
         await withAbort(fsp.rename(tempPath, filePath), signal);
     }
     catch (error) {

package/dist/resources/tool-info.js

@@ -91,8 +91,8 @@ function formatTaskSupportLabel(taskSupport) {
 function formatAnnotationValue(value) {
     return value ? 'true' : 'false';
 }
-function toJsonSchemaObject(schema) {
-    return z.toJSONSchema(schema);
+function toJsonSchemaObject(schema, io = 'output') {
+    return z.toJSONSchema(schema, { io });
 }
 function summarizeSchemaType(schema) {
     if (Array.isArray(schema.enum) && schema.enum.length > 0) {
@@ -119,27 +119,31 @@ function buildSchemaFieldLines(label, schema) {
     if (!schema) {
         return [`<${label}>`, '- none', `</${label}>`];
     }
-    const jsonSchema = toJsonSchemaObject(schema);
+    const io = label === 'input_fields' ? 'input' : 'output';
+    const jsonSchema = toJsonSchemaObject(schema, io);
     const properties = jsonSchema.properties ?? {};
     const required = new Set(jsonSchema.required ?? []);
     const fieldNames = Object.keys(properties);
-    if (fieldNames.length === 0) {
-        return [`<${label}>`, '- object with no fields', `</${label}>`];
+    const lines = [`<${label}>`];
+    if (typeof jsonSchema.description === 'string' &&
+        jsonSchema.description.length > 0) {
+        lines.push(`- Schema constraints: ${jsonSchema.description}`);
     }
-    return [
-        `<${label}>`,
-        ...fieldNames.map((fieldName) => {
-            const fieldSchema = properties[fieldName] ?? {};
-            const type = summarizeSchemaType(fieldSchema);
-            const requiredLabel = required.has(fieldName) ? 'required' : 'optional';
-            const description = typeof fieldSchema.description === 'string' &&
-                fieldSchema.description.length > 0
-                ? fieldSchema.description
-                : 'No description.';
-            return `- ${fieldName} (${type}, ${requiredLabel}): ${description}`;
-        }),
-        `</${label}>`,
-    ];
+    if (fieldNames.length === 0) {
+        lines.push('- object with no fields', `</${label}>`);
+        return lines;
+    }
+    lines.push(...fieldNames.map((fieldName) => {
+        const fieldSchema = properties[fieldName] ?? {};
+        const type = summarizeSchemaType(fieldSchema);
+        const requiredLabel = required.has(fieldName) ? 'required' : 'optional';
+        const description = typeof fieldSchema.description === 'string' &&
+            fieldSchema.description.length > 0
+            ? fieldSchema.description
+            : 'No description.';
+        return `- ${fieldName} (${type}, ${requiredLabel}): ${description}`;
+    }), `</${label}>`);
+    return lines;
 }
 function buildProtocolNotes(contract) {
     const notes = [

package/dist/schemas.d.ts

@@ -63,8 +63,8 @@ export declare const SearchFilesInputSchema: z.ZodObject<{
     sortBy: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
         name: "name";
         size: "size";
-        modified: "modified";
         path: "path";
+        modified: "modified";
     }>>>;
     maxDepth: z.ZodOptional<z.ZodInt>;
     cursor: z.ZodOptional<z.ZodString>;

package/dist/schemas.js

@@ -253,7 +253,8 @@ export const ReadFileInputSchema = z
     }),
     includeHash: defaultFalseBoolean('Include SHA-256 hash of full file content'),
 })
-    .superRefine(validateReadRange);
+    .superRefine(validateReadRange)
+    .describe("Use one read mode only: 'head', 'tail', or 'startLine'/'endLine'. 'endLine' requires 'startLine'.");
 export const ReadMultipleFilesInputSchema = z
     .strictObject({
     paths: z
@@ -268,7 +269,8 @@ export const ReadMultipleFilesInputSchema = z
         endLine: 'End line (1-based, inclusive) per file. Requires startLine.',
     }),
 })
-    .superRefine(validateReadRange);
+    .superRefine(validateReadRange)
+    .describe("Use one read mode only: 'head', 'tail', or 'startLine'/'endLine'. 'endLine' requires 'startLine'.");
 export const GetFileInfoInputSchema = z.strictObject({
     path: RequiredPathSchema.describe(DESC_PATH_REQUIRED),
 });
@@ -451,7 +453,8 @@ export const CreateDirectoryInputSchema = z
     .refine((data) => data.path !== undefined || data.paths !== undefined, {
     error: "Either 'path' or 'paths' must be provided",
     path: ['path'],
-});
+})
+    .describe("Provide either 'path' or 'paths'.");
 export const CreateDirectoryOutputSchema = z.strictObject({
     ok: z.boolean(),
     path: z.string().optional(),
@@ -510,7 +513,8 @@ export const MoveFileInputSchema = z
     .refine((data) => (data.source ?? data.sources) !== undefined, {
     error: "Either 'source' or 'sources' must be provided",
     path: ['source'],
-});
+})
+    .describe("Provide either 'source' or 'sources'.");
 export const MoveFileOutputSchema = z.strictObject({
     ok: z.boolean(),
     source: z.string().optional(),

package/dist/server/bootstrap.js

@@ -5,7 +5,7 @@ import { InMemoryTaskMessageQueue, InMemoryTaskStore, } from '@modelcontextproto
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { isInitializeRequest, SetLevelRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { isInitializeRequest, LATEST_PROTOCOL_VERSION, SetLevelRequestSchema, SUPPORTED_PROTOCOL_VERSIONS, } from '@modelcontextprotocol/sdk/types.js';
 import { DEFAULT_LOG_LEVEL, parseEnvInt } from '../lib/constants.js';
 import { formatUnknownErrorMessage } from '../lib/errors.js';
 import { withAllowedDirectoriesState } from '../lib/paths.js';
@@ -243,7 +243,7 @@ async function readRequestBody(req) {
         req.on('error', reject);
     });
 }
-async function createHttpSession(options, sessions) {
+async function createHttpSession(options, sessions, negotiatedProtocolVersion) {
     const mcpServer = await createServer(options);
     const rootsManager = getRootsManager(mcpServer);
     rootsManager.registerHandlers(mcpServer);
@@ -255,6 +255,7 @@ async function createHttpSession(options, sessions) {
                 server: mcpServer,
                 rootsManager,
                 transport,
+                negotiatedProtocolVersion,
             });
             rootsManager.logMissingDirectoriesIfNeeded(mcpServer);
         },
@@ -270,7 +271,12 @@ async function createHttpSession(options, sessions) {
         });
     };
     await mcpServer.connect(transport);
-    return { server: mcpServer, rootsManager, transport };
+    return {
+        server: mcpServer,
+        rootsManager,
+        transport,
+        negotiatedProtocolVersion,
+    };
 }
 function sendJsonRpcError(res, status, code, message) {
     res.writeHead(status, { 'Content-Type': 'application/json' });
@@ -299,6 +305,29 @@ function getSessionId(req) {
         ? rawSessionId
         : undefined;
 }
+function getProtocolVersionHeader(req) {
+    const rawProtocolVersion = req.headers['mcp-protocol-version'];
+    return typeof rawProtocolVersion === 'string'
+        ? rawProtocolVersion
+        : undefined;
+}
+function resolveNegotiatedProtocolVersion(requestedVersion) {
+    return SUPPORTED_PROTOCOL_VERSIONS.includes(requestedVersion)
+        ? requestedVersion
+        : LATEST_PROTOCOL_VERSION;
+}
+function ensureSessionProtocolVersion(req, res, session) {
+    const protocolVersion = getProtocolVersionHeader(req);
+    if (!protocolVersion) {
+        sendJsonRpcError(res, 400, JSON_RPC_SERVER_ERROR, 'Bad Request: Missing MCP-Protocol-Version header');
+        return false;
+    }
+    if (protocolVersion !== session.negotiatedProtocolVersion) {
+        sendJsonRpcError(res, 400, JSON_RPC_SERVER_ERROR, `Bad Request: MCP-Protocol-Version must match negotiated version ${session.negotiatedProtocolVersion}`);
+        return false;
+    }
+    return true;
+}
 function isAuthorizedBearer(apiKey, authHeader) {
     const bearerPrefix = 'Bearer ';
     if (typeof authHeader !== 'string' || !authHeader.startsWith(bearerPrefix)) {
@@ -385,6 +414,10 @@ export async function startHttpServer(port, options) {
                         discardRequestBody(req);
                         return;
                     }
+                    if (!ensureSessionProtocolVersion(req, res, session)) {
+                        discardRequestBody(req);
+                        return;
+                    }
                     const body = await readRequestBody(req);
                     await handleSessionTransportRequest(session, req, res, body);
                     return;
@@ -396,7 +429,7 @@ export async function startHttpServer(port, options) {
                         sendJsonRpcError(res, 503, JSON_RPC_SERVER_ERROR, 'Too many sessions');
                         return;
                     }
-                    const session = await createHttpSession(options, sessions);
+                    const session = await createHttpSession(options, sessions, resolveNegotiatedProtocolVersion(body.params.protocolVersion));
                     await handleSessionTransportRequest(session, req, res, body);
                     return;
                 }
@@ -411,6 +444,8 @@ export async function startHttpServer(port, options) {
                 const session = getSessionOrRespondNotFound(sessions, sessionId, res);
                 if (!session)
                     return;
+                if (!ensureSessionProtocolVersion(req, res, session))
+                    return;
                 await handleSessionTransportRequest(session, req, res);
             }
             else {