@mastra/mcp 1.17.0-alpha.0 → 1.17.0-alpha.2

package/dist/index.cjs

@@ -5031,7 +5031,7 @@ const allowsEval = /* @__PURE__*/ cached(() => {
 		return false;
 	}
 });
-function isPlainObject(o) {
+function isPlainObject$1(o) {
 	if (isObject(o) === false) return false;
 	const ctor = o.constructor;
 	if (ctor === void 0) return true;
@@ -5042,7 +5042,7 @@ function isPlainObject(o) {
 	return true;
 }
 function shallowClone(o) {
-	if (isPlainObject(o)) return { ...o };
+	if (isPlainObject$1(o)) return { ...o };
 	if (Array.isArray(o)) return [...o];
 	if (o instanceof Map) return new Map(o);
 	if (o instanceof Set) return new Set(o);
@@ -5125,7 +5125,7 @@ function omit(schema, mask) {
 	}));
 }
 function extend(schema, shape) {
-	if (!isPlainObject(shape)) throw new Error("Invalid input to extend: expected a plain object");
+	if (!isPlainObject$1(shape)) throw new Error("Invalid input to extend: expected a plain object");
 	const checks = schema._zod.def.checks;
 	if (checks && checks.length > 0) {
 		const existingShape = schema._zod.def.shape;
@@ -5141,7 +5141,7 @@ function extend(schema, shape) {
 	} }));
 }
 function safeExtend(schema, shape) {
-	if (!isPlainObject(shape)) throw new Error("Invalid input to safeExtend: expected a plain object");
+	if (!isPlainObject$1(shape)) throw new Error("Invalid input to safeExtend: expected a plain object");
 	return clone(schema, mergeDefs(schema._zod.def, { get shape() {
 		const _shape = {
 			...schema._zod.def.shape,
@@ -6826,7 +6826,7 @@ function mergeValues(a, b) {
 		valid: true,
 		data: a
 	};
-	if (isPlainObject(a) && isPlainObject(b)) {
+	if (isPlainObject$1(a) && isPlainObject$1(b)) {
 		const bKeys = Object.keys(b);
 		const sharedKeys = Object.keys(a).filter((key) => bKeys.indexOf(key) !== -1);
 		const newObj = {
@@ -6994,7 +6994,7 @@ const $ZodRecord = /*@__PURE__*/ $constructor("$ZodRecord", (inst, def) => {
 	$ZodType.init(inst, def);
 	inst._zod.parse = (payload, ctx) => {
 		const input = payload.value;
-		if (!isPlainObject(input)) {
+		if (!isPlainObject$1(input)) {
 			payload.issues.push({
 				expected: "record",
 				code: "invalid_type",
@@ -21322,44 +21322,21 @@ function extractModelTextFromToolContent(content) {
 * `toModelOutput` can read MCP `content` without changing the execute return shape.
 */
 const MCP_CALL_TOOL_CONTENT = Symbol.for("mastra.mcp.callToolContent");
-function reserveScalarMcpContent(queue) {
-	const reservation = { ready: false };
-	queue.push(reservation);
-	return reservation;
-}
-function removeScalarMcpContentReservation(queue, reservation) {
-	if (!reservation) return;
-	const index = queue.indexOf(reservation);
-	if (index !== -1) queue.splice(index, 1);
-}
-function attachMcpCallToolContent(structuredContent, content, scalarMcpContentQueue, reservation) {
-	if (structuredContent !== null && typeof structuredContent === "object") {
-		removeScalarMcpContentReservation(scalarMcpContentQueue, reservation);
-		Object.defineProperty(structuredContent, MCP_CALL_TOOL_CONTENT, {
-			value: content,
-			enumerable: false,
-			configurable: true
-		});
-		return structuredContent;
-	}
-	if (reservation) {
-		reservation.output = structuredContent;
-		reservation.content = content;
-		reservation.ready = true;
-	}
+function attachMcpCallToolContent(structuredContent, content) {
+	if (structuredContent !== null && typeof structuredContent === "object") Object.defineProperty(structuredContent, MCP_CALL_TOOL_CONTENT, {
+		value: content,
+		enumerable: false,
+		configurable: true
+	});
 	return structuredContent;
 }
-function getMcpCallToolContent(output, scalarMcpContentQueue) {
-	if (output !== null && typeof output === "object") {
-		const attached = output[MCP_CALL_TOOL_CONTENT];
-		if (attached !== void 0) return attached;
-	}
-	const index = scalarMcpContentQueue.findIndex((entry) => entry.ready && Object.is(entry.output, output));
-	if (index !== -1) return scalarMcpContentQueue.splice(index, 1)[0]?.content;
+function getMcpCallToolContent(output) {
+	if (output === null || typeof output !== "object") return void 0;
+	return output[MCP_CALL_TOOL_CONTENT];
 }
-function createStructuredToolToModelOutput(scalarMcpContentQueue) {
+function createStructuredToolToModelOutput() {
 	return (output) => {
-		const modelText = extractModelTextFromToolContent(getMcpCallToolContent(output, scalarMcpContentQueue));
+		const modelText = extractModelTextFromToolContent(getMcpCallToolContent(output));
 		if (modelText !== void 0) return {
 			type: "text",
 			value: modelText
@@ -21483,12 +21460,14 @@ var InternalMastraMCPClient = class extends _mastra_core_base.MastraBase {
 				"io.modelcontextprotocol/ui": {}
 			}
 		};
+		const versionNegotiation = server.protocolVersion === void 0 ? void 0 : { mode: server.protocolVersion === "auto" ? "auto" : { pin: server.protocolVersion } };
 		this.client = new _modelcontextprotocol_client.Client({
 			name,
 			version
 		}, {
 			capabilities: clientCapabilities,
-			...server.jsonSchemaValidator ? { jsonSchemaValidator: server.jsonSchemaValidator } : {}
+			...server.jsonSchemaValidator ? { jsonSchemaValidator: server.jsonSchemaValidator } : {},
+			...versionNegotiation ? { versionNegotiation } : {}
 		});
 		this.setupLogging();
 		if (hasRoots) this.setupRootsHandler();
@@ -21656,7 +21635,7 @@ var InternalMastraMCPClient = class extends _mastra_core_base.MastraBase {
 					this.markNeedsAuth(streamableTransport);
 					throw error;
 				}
-				if (isUrlPolicyError(error)) throw error;
+				if (isUrlPolicyError(error) || this.serverConfig.protocolVersion === "2026-07-28") throw error;
 				const status = error instanceof _modelcontextprotocol_client.SdkHttpError ? error.status : void 0;
 				if (status !== void 0 && !SSE_FALLBACK_STATUS_CODES.includes(status)) throw error;
 				shouldTrySSE = true;
@@ -22207,7 +22186,6 @@ var InternalMastraMCPClient = class extends _mastra_core_base.MastraBase {
 				...toolMeta ? { _meta: toolMeta } : {},
 				...annotations ? { annotations } : {}
 			} } : {};
-			const scalarMcpContentQueue = [];
 			const mastraTool = (0, _mastra_core_tools.createTool)({
 				id: `${this.name}_${tool.name}`,
 				description: tool.description || "",
@@ -22223,11 +22201,10 @@ var InternalMastraMCPClient = class extends _mastra_core_base.MastraBase {
 					forwardInstructions: this.forwardInstructions,
 					instructionsMaxLength: this.instructionsMaxLength
 				},
-				...tool.outputSchema ? { toModelOutput: createStructuredToolToModelOutput(scalarMcpContentQueue) } : {},
+				...tool.outputSchema ? { toModelOutput: createStructuredToolToModelOutput() } : {},
 				execute: async (input, context) => {
 					if (serverMeta.connectFirst) await this.connect();
 					const operationContext = context?.requestContext ?? null;
-					const scalarMcpContentReservation = tool.outputSchema ? reserveScalarMcpContent(scalarMcpContentQueue) : void 0;
 					return this.operationContextStore.run(operationContext, async () => {
 						const executeToolCall = async () => {
 							this.log("debug", `Executing tool: ${tool.name}`, {
@@ -22263,8 +22240,7 @@ var InternalMastraMCPClient = class extends _mastra_core_base.MastraBase {
 								});
 							}
 							this.log("debug", `Tool executed successfully: ${tool.name}`);
-							if (res.structuredContent !== void 0) return attachMcpCallToolContent(res.structuredContent, res.content, scalarMcpContentQueue, scalarMcpContentReservation);
-							removeScalarMcpContentReservation(scalarMcpContentQueue, scalarMcpContentReservation);
+							if (res.structuredContent !== void 0) return attachMcpCallToolContent(res.structuredContent, res.content);
 							return res;
 						};
 						const failedTransport = this.transport;
@@ -22284,7 +22260,6 @@ var InternalMastraMCPClient = class extends _mastra_core_base.MastraBase {
 										reconnectError: reconnectError instanceof Error ? reconnectError.stack : String(reconnectError),
 										toolArgs: input
 									});
-									removeScalarMcpContentReservation(scalarMcpContentQueue, scalarMcpContentReservation);
 									throw reconnectError;
 								}
 							}
@@ -22292,7 +22267,6 @@ var InternalMastraMCPClient = class extends _mastra_core_base.MastraBase {
 								error: e instanceof Error ? e.stack : JSON.stringify(e, null, 2),
 								toolArgs: input
 							});
-							removeScalarMcpContentReservation(scalarMcpContentQueue, scalarMcpContentReservation);
 							throw e;
 						}
 					});
@@ -24320,7 +24294,7 @@ var streamSSE = (c, cb, onError) => {
 	return c.newResponse(stream.responseReadable);
 };
 //#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@modelcontextprotocol/sdk/1.29.0/989ce0cb833930f9ef8da3e25bac11110cfeac46669bc69ae9534a6aa55b0aa7/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@modelcontextprotocol/sdk/1.29.0/7d2f0982429dbe53f84f7249d02074ef571f5d1c95137997d9ed2dfe102a137b/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 const RELATED_TASK_META_KEY = "io.modelcontextprotocol/related-task";
 /**
 * Assert 'object' type schema.
@@ -26151,7 +26125,7 @@ union([
 	CreateTaskResultSchema
 ]);
 //#endregion
-//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/hono-mcp-server-sse-transport/0.0.7/518df2f53e0bbb46e48def5118fc7f6b5bba3a268854c8a5c7e83260299d376e/node_modules/hono-mcp-server-sse-transport/build/sse.js
+//#region ../../../../../setup-pnpm/node_modules/.bin/store/v11/links/@/hono-mcp-server-sse-transport/0.0.7/d5ae5a23aa2b79db7055621f11a7cbc8d27f7caba1eeb308ab2cf5bcb1a8e5b8/node_modules/hono-mcp-server-sse-transport/build/sse.js
 const MAXIMUM_MESSAGE_SIZE = 4 * 1024 * 1024;
 var SSETransport = class {
 	messageUrl;
@@ -26226,6 +26200,132 @@ var SSETransport = class {
 	}
 };
 //#endregion
+//#region src/server/mrtrElicitation.ts
+/**
+* Elicitation on the 2026-07-28 protocol revision (multi-round-trip requests).
+*
+* The modern era has no server→client request channel, so `server.elicitInput()`
+* throws there by design. Instead, the `tools/call` handler must RETURN an
+* `input_required` result carrying the embedded elicitation request; the client
+* answers it locally and RETRIES the call with the response attached
+* (`inputResponses`). This module keeps the promise-shaped
+* `elicitation.sendRequest()` API tools already use by replaying the tool:
+*
+* 1. Each `sendRequest` call is assigned a deterministic sequence key.
+* 2. If the current (retried) request carries an answer for that key — either in
+*    this round's `inputResponses` or in the accumulated `requestState` from
+*    prior rounds — the promise resolves with it immediately.
+* 3. Otherwise a {@link ElicitationReplayInterrupt} is thrown; the `tools/call`
+*    handler converts it into an {@link InputRequiredResult} return, and the
+*    client's retry re-executes the tool from the top.
+*
+* Consequences tools must live with on the modern leg:
+* - Code before an unanswered elicitation re-executes on every round; keep side
+*   effects idempotent or place them after the last elicitation.
+* - Elicitation order must be deterministic for a given input, since answers are
+*   matched by call sequence.
+*/
+const ELICIT_KEY_PREFIX = "mastra_elicit_";
+/**
+* Thrown by the replay-based `sendRequest` when the current round carries no
+* answer for the elicitation. Never surfaces to tools or clients: the
+* `tools/call` handler converts it into an `input_required` result.
+*/
+var ElicitationReplayInterrupt = class extends Error {
+	key;
+	params;
+	answered;
+	constructor(key, params, answered) {
+		super(`Elicitation '${key}' requires client input (multi-round-trip)`);
+		this.key = key;
+		this.params = params;
+		this.answered = answered;
+		this.name = "ElicitationReplayInterrupt";
+	}
+};
+const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const looksLikeElicitResult = (value) => isPlainObject(value) && typeof value.action === "string";
+/**
+* Decodes the accumulated prior-round answers from the request's opaque
+* `requestState` echo. The state round-trips through the client, so it is
+* attacker-controlled input on re-entry — but its only content is the client's
+* own past elicitation answers, which are untrusted user input either way, so
+* tampering grants the client nothing it does not already control. Anything
+* that does not parse as a map of elicitation results is discarded.
+*/
+const decodePriorAnswers = (extra) => {
+	const raw = extra.mcpReq.requestState();
+	if (typeof raw !== "string" || raw.length === 0) return {};
+	try {
+		const parsed = JSON.parse(raw);
+		if (!isPlainObject(parsed)) return {};
+		const answers = {};
+		for (const [key, value] of Object.entries(parsed)) if (key.startsWith(ELICIT_KEY_PREFIX) && looksLikeElicitResult(value)) answers[key] = value;
+		return answers;
+	} catch {
+		return {};
+	}
+};
+/** This round's bare responses that answer our elicitation keys. */
+const currentRoundAnswers = (extra) => {
+	const answers = {};
+	for (const [key, value] of Object.entries(extra.mcpReq.inputResponses ?? {})) if (key.startsWith(ELICIT_KEY_PREFIX) && looksLikeElicitResult(value)) answers[key] = value;
+	return answers;
+};
+/**
+* Whether this request is served on the 2026-07-28 era. Modern clients always
+* attach the reserved per-request `_meta` envelope (the 2026 codec enforces the
+* required keys at dispatch); legacy requests never carry it.
+*/
+const isModernEraRequest = (extra) => extra.mcpReq.envelope !== void 0;
+/**
+* Builds the replay-based {@link ElicitationActions} for one modern-era tool
+* execution. Answers already provided by the client resolve immediately; the
+* first unanswered elicitation throws {@link ElicitationReplayInterrupt}.
+*
+* The interrupt is also reported through `onInterrupt` before it is thrown:
+* tool wrappers (e.g. Mastra's tool builder) re-wrap thrown errors, so the
+* `tools/call` handler cannot rely on `instanceof` on whatever escapes the
+* tool — the out-of-band capture is the authoritative signal.
+*/
+const createReplayElicitation = (extra, onInterrupt) => {
+	const prior = decodePriorAnswers(extra);
+	const current = currentRoundAnswers(extra);
+	const answered = {
+		...prior,
+		...current
+	};
+	let sequence = 0;
+	return { sendRequest: async (request) => {
+		const key = `${ELICIT_KEY_PREFIX}${sequence++}`;
+		const answer = answered[key];
+		if (answer !== void 0) return answer;
+		const interrupt = new ElicitationReplayInterrupt(key, request, answered);
+		onInterrupt(interrupt);
+		throw interrupt;
+	} };
+};
+/**
+* Converts a caught {@link ElicitationReplayInterrupt} into the
+* `input_required` result the `tools/call` handler returns to the client.
+* Prior answers travel in `requestState` because each retry only carries the
+* current round's `inputResponses`.
+*/
+const replayInterruptToInputRequired = (interrupt) => {
+	const params = {
+		mode: "form",
+		...interrupt.params
+	};
+	return {
+		resultType: "input_required",
+		inputRequests: { [interrupt.key]: {
+			method: "elicitation/create",
+			params
+		} },
+		...Object.keys(interrupt.answered).length > 0 ? { requestState: JSON.stringify(interrupt.answered) } : {}
+	};
+};
+//#endregion
 //#region src/server/notificationBroadcast.ts
 /**
 * Sends a notification to every active server instance (the main stdio/SSE
@@ -26282,6 +26382,7 @@ var ServerPromptActions = class {
 	getLogger;
 	getSdkServers;
 	clearDefinedPrompts;
+	getModernEraNotifier;
 	/**
 	* @internal
 	*/
@@ -26289,6 +26390,7 @@ var ServerPromptActions = class {
 		this.getLogger = dependencies.getLogger;
 		this.getSdkServers = dependencies.getSdkServers;
 		this.clearDefinedPrompts = dependencies.clearDefinedPrompts;
+		this.getModernEraNotifier = dependencies.getModernEraNotifier;
 	}
 	/**
 	* Notifies clients that the overall list of available prompts has changed.
@@ -26307,6 +26409,7 @@ var ServerPromptActions = class {
 	async notifyListChanged() {
 		this.getLogger().info("Prompt list change externally notified. Clearing definedPrompts and sending notification.");
 		this.clearDefinedPrompts();
+		this.getModernEraNotifier?.()?.promptsChanged();
 		await broadcastNotification({
 			servers: this.getSdkServers(),
 			send: (server) => server.sendPromptListChanged(),
@@ -26333,6 +26436,7 @@ var ServerResourceActions = class {
 	getSubscribedServers;
 	getLogger;
 	getSdkServers;
+	getModernEraNotifier;
 	/**
 	* @internal
 	*/
@@ -26340,6 +26444,7 @@ var ServerResourceActions = class {
 		this.getSubscribedServers = dependencies.getSubscribedServers;
 		this.getLogger = dependencies.getLogger;
 		this.getSdkServers = dependencies.getSdkServers;
+		this.getModernEraNotifier = dependencies.getModernEraNotifier;
 	}
 	/**
 	* Notifies subscribed clients that a specific resource has been updated.
@@ -26359,6 +26464,7 @@ var ServerResourceActions = class {
 	* ```
 	*/
 	async notifyUpdated({ uri }) {
+		this.getModernEraNotifier?.()?.resourceUpdated(uri);
 		const subscribedServers = this.getSubscribedServers(uri);
 		if (subscribedServers.length === 0) {
 			this.getLogger().debug(`Resource ${uri} was updated, but no active subscriptions for it.`);
@@ -26391,6 +26497,7 @@ var ServerResourceActions = class {
 	*/
 	async notifyListChanged() {
 		this.getLogger().info("Resource list change externally notified. Sending notification.");
+		this.getModernEraNotifier?.()?.resourcesChanged();
 		await broadcastNotification({
 			servers: this.getSdkServers(),
 			send: (server) => server.sendResourceListChanged(),
@@ -26416,6 +26523,7 @@ var ServerToolActions = class {
 	getSdkServers;
 	addTools;
 	removeTools;
+	getModernEraNotifier;
 	/**
 	* @internal
 	*/
@@ -26424,6 +26532,7 @@ var ServerToolActions = class {
 		this.getSdkServers = dependencies.getSdkServers;
 		this.addTools = dependencies.addTools;
 		this.removeTools = dependencies.removeTools;
+		this.getModernEraNotifier = dependencies.getModernEraNotifier;
 	}
 	/**
 	* Registers new tools on the running server and notifies connected clients
@@ -26482,6 +26591,7 @@ var ServerToolActions = class {
 	*/
 	async notifyListChanged() {
 		this.getLogger().info("Tool list changed. Sending notification.");
+		this.getModernEraNotifier?.()?.toolsChanged();
 		await broadcastNotification({
 			servers: this.getSdkServers(),
 			send: (server) => server.sendToolListChanged(),
@@ -26522,6 +26632,14 @@ const LOG_LEVEL_SEVERITY = {
 	alert: 6,
 	emergency: 7
 };
+const ACCEPTED_MODERN_ERA_HTTP_OPTION_KEYS = /* @__PURE__ */ new Set([
+	"allowedHosts",
+	"allowedOrigins",
+	"enableDnsRebindingProtection",
+	"serverless",
+	"serverlessStreaming",
+	"sessionIdGenerator"
+]);
 /**
 * MCPServer exposes Mastra tools, agents, and workflows as a Model Context Protocol (MCP) server.
 *
@@ -26555,6 +26673,8 @@ var MCPServer = class extends _mastra_core_mcp.MCPServerBase {
 	stdioTransport;
 	sseTransport;
 	sseHonoTransports;
+	/** Auth info for the in-flight Hono SSE message POST, keyed by session id. */
+	sseHonoAuthInfo = /* @__PURE__ */ new Map();
 	streamableHTTPTransports = /* @__PURE__ */ new Map();
 	httpServerInstances = /* @__PURE__ */ new Map();
 	resourceOptions;
@@ -26566,6 +26686,12 @@ var MCPServer = class extends _mastra_core_mcp.MCPServerBase {
 	fga;
 	subscriptionsByInstance = /* @__PURE__ */ new WeakMap();
 	loggingLevels = /* @__PURE__ */ new WeakMap();
+	protocolVersion;
+	cacheHints;
+	modernEraHandler;
+	modernEraNodeHandler;
+	stdioHandle;
+	stdioServerInstance;
 	/**
 	* Provides methods to notify clients about resource changes.
 	*
@@ -26717,6 +26843,8 @@ var MCPServer = class extends _mastra_core_mcp.MCPServerBase {
 	*/
 	constructor(opts) {
 		super(opts);
+		this.protocolVersion = opts.protocolVersion;
+		this.cacheHints = opts.cacheHints;
 		this.resourceOptions = this.mergeAppResources(opts.resources, opts.appResources);
 		this.hasUiResources = !!opts.appResources && Object.keys(opts.appResources).length > 0;
 		this.promptOptions = opts.prompts;
@@ -26742,7 +26870,8 @@ var MCPServer = class extends _mastra_core_mcp.MCPServerBase {
 		}, {
 			capabilities,
 			...this.instructions ? { instructions: this.instructions } : {},
-			...this.jsonSchemaValidator ? { jsonSchemaValidator: this.jsonSchemaValidator } : {}
+			...this.jsonSchemaValidator ? { jsonSchemaValidator: this.jsonSchemaValidator } : {},
+			...this.servesModernEra() && this.cacheHints ? { cacheHints: this.cacheHints } : {}
 		});
 		this.logger.info("Initialized MCPServer", {
 			name: this.name,
@@ -26753,23 +26882,27 @@ var MCPServer = class extends _mastra_core_mcp.MCPServerBase {
 		});
 		this.sseHonoTransports = /* @__PURE__ */ new Map();
 		this.registerHandlersOnServer(this.server);
+		const getModernEraNotifier = () => this.servesModernEra() ? this.modernEraHandler?.notify : void 0;
 		this.resources = new ServerResourceActions({
 			getSubscribedServers: (uri) => this.getAllSdkServers().filter((server) => this.subscriptionsByInstance.get(server)?.has(uri)),
 			getLogger: () => this.logger,
-			getSdkServers: () => this.getAllSdkServers()
+			getSdkServers: () => this.getAllSdkServers(),
+			getModernEraNotifier
 		});
 		this.prompts = new ServerPromptActions({
 			getLogger: () => this.logger,
 			getSdkServers: () => this.getAllSdkServers(),
 			clearDefinedPrompts: () => {
 				this.definedPrompts = void 0;
-			}
+			},
+			getModernEraNotifier
 		});
 		this.toolActions = new ServerToolActions({
 			getLogger: () => this.logger,
 			getSdkServers: () => this.getAllSdkServers(),
 			addTools: (tools) => this.addTools(tools),
-			removeTools: (toolIds) => this.removeTools(toolIds)
+			removeTools: (toolIds) => this.removeTools(toolIds),
+			getModernEraNotifier
 		});
 		this.elicitation = { sendRequest: async (request, options) => {
 			return this.handleElicitationRequest(request, void 0, options);
@@ -26785,7 +26918,69 @@ var MCPServer = class extends _mastra_core_mcp.MCPServerBase {
 	* cannot receive notifications.
 	*/
 	getAllSdkServers() {
-		return [this.server, ...this.httpServerInstances.values()].filter((server) => server.transport !== void 0);
+		return [
+			this.server,
+			this.stdioServerInstance,
+			...this.httpServerInstances.values()
+		].filter((server) => server?.transport !== void 0);
+	}
+	/**
+	* Whether the server is pinned to the `2026-07-28` protocol revision.
+	* When false (the default), all behavior is byte-identical to the legacy era.
+	*/
+	servesModernEra() {
+		return this.protocolVersion === "2026-07-28";
+	}
+	assertModernEraHTTPOptions(options) {
+		if (!options) return;
+		const incompatibleOptions = new Set(Object.keys(options).filter((option) => !ACCEPTED_MODERN_ERA_HTTP_OPTION_KEYS.has(option)));
+		if (options.sessionIdGenerator !== void 0) incompatibleOptions.add("sessionIdGenerator");
+		if (options.serverless === false) incompatibleOptions.add("serverless");
+		if (options.serverlessStreaming === false) incompatibleOptions.add("serverlessStreaming");
+		if (incompatibleOptions.size === 0) return;
+		const names = [...incompatibleOptions].sort();
+		throw new _mastra_core_error.MastraError({
+			id: "MCP_SERVER_MODERN_HTTP_OPTIONS_INCOMPATIBLE",
+			domain: _mastra_core_error.ErrorDomain.MCP,
+			category: _mastra_core_error.ErrorCategory.USER,
+			text: `startHTTP options ${names.map((name) => `"${name}"`).join(", ")} are incompatible with protocolVersion "2026-07-28"`,
+			details: { incompatibleOptions: names.join(", ") }
+		});
+	}
+	validateHTTPRequestHeaders(req, res, options) {
+		if (!options?.enableDnsRebindingProtection) return true;
+		if (options.allowedHosts?.length) {
+			if (!(0, _modelcontextprotocol_node.hostHeaderValidation)(options.allowedHosts.map((host) => new URL(`http://${host}`).hostname))(req, res)) return false;
+		}
+		if (options.allowedOrigins?.length) {
+			if (!(0, _modelcontextprotocol_node.originValidation)(options.allowedOrigins.map((origin) => new URL(origin).hostname))(req, res)) return false;
+		}
+		return true;
+	}
+	/**
+	* Lazily creates the dual-era HTTP handler used when `protocolVersion: '2026-07-28'`
+	* is set: modern (per-request envelope) clients are served natively and legacy
+	* clients are served through the SDK's built-in stateless fallback, both from the
+	* same endpoint. Each request gets a fresh server instance from
+	* `createServerInstance()`, so all registered handlers apply to both eras.
+	*/
+	getModernEraHandler() {
+		if (!this.modernEraHandler) this.modernEraHandler = (0, _modelcontextprotocol_server.createMcpHandler)(() => this.createServerInstance(), {
+			legacy: "stateless",
+			onerror: (error) => {
+				this.logger.error("MCP handler error", { error: error.toString() });
+			}
+		});
+		return this.modernEraHandler;
+	}
+	/**
+	* Node `(req, res)` adapter over the dual-era handler's web-standard `fetch`.
+	*/
+	getModernEraNodeHandler() {
+		if (!this.modernEraNodeHandler) this.modernEraNodeHandler = (0, _modelcontextprotocol_node.toNodeHandler)(this.getModernEraHandler(), { onerror: (error) => {
+			this.logger.error("MCP Node handler adapter error", { error: error.toString() });
+		} });
+		return this.modernEraNodeHandler;
 	}
 	/**
 	* Determines whether a log message at the given level should be sent to the
@@ -27022,7 +27217,8 @@ var MCPServer = class extends _mastra_core_mcp.MCPServerBase {
 		}, {
 			capabilities,
 			...this.instructions ? { instructions: this.instructions } : {},
-			...this.jsonSchemaValidator ? { jsonSchemaValidator: this.jsonSchemaValidator } : {}
+			...this.jsonSchemaValidator ? { jsonSchemaValidator: this.jsonSchemaValidator } : {},
+			...this.servesModernEra() && this.cacheHints ? { cacheHints: this.cacheHints } : {}
 		});
 		this.registerHandlersOnServer(serverInstance);
 		return serverInstance;
@@ -27065,6 +27261,7 @@ var MCPServer = class extends _mastra_core_mcp.MCPServerBase {
 		serverInstance.setRequestHandler("tools/call", async (request, ctx) => {
 			const startTime = Date.now();
 			const extra = toMCPRequestHandlerExtra(ctx);
+			let replayInterrupt;
 			try {
 				const tool = this.convertedTools[request.params.name];
 				if (!tool) {
@@ -27104,11 +27301,20 @@ var MCPServer = class extends _mastra_core_mcp.MCPServerBase {
 						isError: true
 					};
 				}
-				const sessionElicitation = { sendRequest: async (request, options) => {
+				const sessionElicitation = isModernEraRequest(extra) ? createReplayElicitation(extra, (interrupt) => {
+					replayInterrupt = interrupt;
+				}) : { sendRequest: async (request, options) => {
 					return this.handleElicitationRequest(request, serverInstance, options);
 				} };
 				const proxiedContext = await this.createProxiedRequestContext(extra);
 				const sessionLog = async (level, message, data) => {
+					if (this.servesModernEra()) {
+						await extra.mcpReq.log(level, {
+							message,
+							...data
+						}, this.name);
+						return;
+					}
 					if (!this.shouldSendLog(serverInstance, level)) return;
 					await extra.sendNotification({
 						method: "notifications/message",
@@ -27198,6 +27404,10 @@ var MCPServer = class extends _mastra_core_mcp.MCPServerBase {
 				}];
 				return response;
 			} catch (error) {
+				if (replayInterrupt !== void 0) {
+					this.logger.debug(`CallTool: Tool '${request.params.name}' requires client input (multi-round-trip).`, { key: replayInterrupt.key });
+					return replayInterruptToInputRequired(replayInterrupt);
+				}
 				const duration = Date.now() - startTime;
 				if (error instanceof Error && "issues" in error && Array.isArray(error.issues)) {
 					const issues = error.issues;
@@ -27613,6 +27823,17 @@ var MCPServer = class extends _mastra_core_mcp.MCPServerBase {
 	* ```
 	*/
 	async startStdio() {
+		if (this.servesModernEra()) {
+			this.stdioHandle = (0, _modelcontextprotocol_server_stdio.serveStdio)(() => {
+				const serverInstance = this.createServerInstance();
+				this.stdioServerInstance = serverInstance;
+				return serverInstance;
+			}, { onerror: (error) => {
+				this.logger.error("MCP stdio handler error", { error: error.toString() });
+			} });
+			this.logger.info("Started MCP Server (stdio, 2026-07-28 dual-era)");
+			return;
+		}
 		this.stdioTransport = new _modelcontextprotocol_server_stdio.StdioServerTransport();
 		try {
 			await this.server.connect(this.stdioTransport);
@@ -27731,7 +27952,7 @@ var MCPServer = class extends _mastra_core_mcp.MCPServerBase {
 	* export default app;
 	* ```
 	*/
-	async startHonoSSE({ url, ssePath, messagePath, context }) {
+	async startHonoSSE({ url, ssePath, messagePath, context, authInfo }) {
 		const honoContext = context;
 		try {
 			if (url.pathname === ssePath) return streamSSE(honoContext, async (stream) => {
@@ -27746,6 +27967,8 @@ var MCPServer = class extends _mastra_core_mcp.MCPServerBase {
 				this.logger.debug("Received message for sessionId", { sessionId });
 				if (!sessionId) return honoContext.text("No sessionId provided", 400);
 				if (!this.sseHonoTransports.has(sessionId)) return honoContext.text(`No transport found for sessionId ${sessionId}`, 400);
+				if (authInfo) this.sseHonoAuthInfo.set(sessionId, authInfo);
+				else this.sseHonoAuthInfo.delete(sessionId);
 				const message = await this.sseHonoTransports.get(sessionId)?.handlePostMessage(honoContext);
 				if (!message) return honoContext.text("Transport not found", 400);
 				return message;
@@ -27845,6 +28068,34 @@ var MCPServer = class extends _mastra_core_mcp.MCPServerBase {
 			res.end();
 			return;
 		}
+		if (this.servesModernEra()) this.assertModernEraHTTPOptions(options);
+		if (!this.validateHTTPRequestHeaders(req, res, options)) return;
+		if (this.servesModernEra()) {
+			try {
+				await this.getModernEraNodeHandler()(req, res);
+			} catch (error) {
+				const mastraError = new _mastra_core_error.MastraError({
+					id: "MCP_SERVER_HTTP_CONNECTION_FAILED",
+					domain: _mastra_core_error.ErrorDomain.MCP,
+					category: _mastra_core_error.ErrorCategory.USER,
+					text: "Failed to handle MCP request on the 2026-07-28 protocol path"
+				}, error);
+				this.logger.trackException(mastraError);
+				this.logger.error("Error handling HTTP request (2026-07-28 path)", { error: mastraError });
+				if (!res.headersSent) {
+					res.writeHead(500, { "Content-Type": "application/json" });
+					res.end(JSON.stringify({
+						jsonrpc: "2.0",
+						error: {
+							code: -32603,
+							message: "Internal server error"
+						},
+						id: null
+					}));
+				}
+			}
+			return;
+		}
 		if (options?.serverless || options && "sessionIdGenerator" in options && options.sessionIdGenerator === void 0) {
 			this.logger.debug("Running in stateless mode");
 			const enableJsonResponse = options?.enableJsonResponse ?? !options?.serverlessStreaming;
@@ -28098,12 +28349,22 @@ var MCPServer = class extends _mastra_core_mcp.MCPServerBase {
 		stream.onAbort(() => {
 			this.logger.debug("SSE Transport aborted with sessionId:", { sessionId });
 			this.sseHonoTransports.delete(sessionId);
+			this.sseHonoAuthInfo.delete(sessionId);
 		});
 		try {
 			await this.server.connect(sseTransport);
+			const onmessage = sseTransport.onmessage?.bind(sseTransport);
+			if (onmessage) sseTransport.onmessage = (message, extra) => {
+				const authInfo = this.sseHonoAuthInfo.get(sessionId);
+				onmessage(message, authInfo ? {
+					...extra,
+					authInfo
+				} : extra);
+			};
 			this.server.onclose = async () => {
 				this.logger.debug("SSE Transport closed with sessionId:", { sessionId });
 				this.sseHonoTransports.delete(sessionId);
+				this.sseHonoAuthInfo.delete(sessionId);
 				await this.server.close();
 			};
 			while (true) {
@@ -28143,6 +28404,16 @@ var MCPServer = class extends _mastra_core_mcp.MCPServerBase {
 	*/
 	async close() {
 		try {
+			if (this.stdioHandle) {
+				await this.stdioHandle.close();
+				this.stdioHandle = void 0;
+				this.stdioServerInstance = void 0;
+			}
+			if (this.modernEraHandler) {
+				await this.modernEraHandler.close();
+				this.modernEraHandler = void 0;
+				this.modernEraNodeHandler = void 0;
+			}
 			if (this.stdioTransport) {
 				await this.stdioTransport.close?.();
 				this.stdioTransport = void 0;