@mastra/mcp 1.9.1-alpha.0 → 1.9.2-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # @mastra/mcp
 
+## 1.9.2-alpha.0
+
+### Patch Changes
+
+- Fixed `MCPServer` leaking one caller's resources to other callers. The result of the first `resources/list` request was cached on the shared, long-lived server instance and replayed to everyone, so a dynamic resource provider that scopes resources per user or tenant (resolved from `extra.authInfo`) served the first caller's resource index — names and URIs — to subsequent callers. The same stale cache also backed `resources/read` URI resolution and the public `listResources()` method. The `resources/templates/list` handler had the same defect for dynamic resource template providers. ([#17610](https://github.com/mastra-ai/mastra/pull/17610))
+
+  Resource and resource template providers are now invoked on every request with the current caller's context, so each caller only sees their own resources. See https://github.com/mastra-ai/mastra/issues/17609
+
+- Fixed flaky MCP server tests by replacing real weather API calls with deterministic mock tool ([#17572](https://github.com/mastra-ai/mastra/pull/17572))
+
+- Updated dependencies [[`d468acb`](https://github.com/mastra-ai/mastra/commit/d468acb07aec1bb19a2cb0ada8042b05b46746b2), [`e9be4e7`](https://github.com/mastra-ai/mastra/commit/e9be4e747ec3d8b65548bff92f9377db06105376), [`d53cfc2`](https://github.com/mastra-ai/mastra/commit/d53cfc2c7f8d78343a4aa84ec4e129ba25f3325e), [`65799d4`](https://github.com/mastra-ai/mastra/commit/65799d4d549e5ebb9c848fbe3f51ac090f64becf), [`c268c89`](https://github.com/mastra-ai/mastra/commit/c268c89f4c63a93ee474d3cffdf3ea60bf00d4f2), [`d468acb`](https://github.com/mastra-ai/mastra/commit/d468acb07aec1bb19a2cb0ada8042b05b46746b2), [`0c72f03`](https://github.com/mastra-ai/mastra/commit/0c72f032abb13254df5a7856d64be2f207b8006d), [`3b45ea9`](https://github.com/mastra-ai/mastra/commit/3b45ea95015557a6cb9d70dc5252af54ab1b78ac), [`f084be1`](https://github.com/mastra-ai/mastra/commit/f084be1fcbe33ad7480913e44d6130c421c0976f)]:
+  - @mastra/core@1.42.0-alpha.0
+
+## 1.9.1
+
+### Patch Changes
+
+- Removed Hono from @mastra/core and auth package runtime dependencies. Auth providers now receive framework-agnostic request types that support standard Request objects and Hono-compatible request shapes. MCP and deployer avoid relying on core-bundled Hono context types at package boundaries. ([#17410](https://github.com/mastra-ai/mastra/pull/17410))
+
+- Updated dependencies [[`c973db4`](https://github.com/mastra-ai/mastra/commit/c973db428df1b564ff0c35d4b2a90e8f4f1e13fd), [`552285e`](https://github.com/mastra-ai/mastra/commit/552285e5af43cfc680a0972032cab8de8776c6a0), [`77e686c`](https://github.com/mastra-ai/mastra/commit/77e686c264e493e99ae5024e4dfe3ea5d5a09718), [`ece8dba`](https://github.com/mastra-ai/mastra/commit/ece8dba7ec1a5089eee8c33167cd762bfa91e509), [`e751af2`](https://github.com/mastra-ai/mastra/commit/e751af219433fbf4c7035b2d771b4c9ec8813b05), [`e2a8380`](https://github.com/mastra-ai/mastra/commit/e2a838017a7657850404c1e94c70d79ffdc6f14a), [`be3f1cd`](https://github.com/mastra-ai/mastra/commit/be3f1cd81f0e2a649e8eac15a024d542d814aef8), [`a34d9db`](https://github.com/mastra-ai/mastra/commit/a34d9dbc39fedb722f271318e9355ecee70489ab)]:
+  - @mastra/core@1.39.0
+
 ## 1.9.1-alpha.0
 
 ### Patch Changes

package/dist/docs/SKILL.md

@@ -3,7 +3,7 @@ name: mastra-mcp
 description: Documentation for @mastra/mcp. Use when working with @mastra/mcp APIs, configuration, or implementation.
 metadata:
   package: "@mastra/mcp"
-  version: "1.9.1-alpha.0"
+  version: "1.9.2-alpha.0"
 ---
 
 ## When to use

package/dist/docs/assets/SOURCE_MAP.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.9.1-alpha.0",
+  "version": "1.9.2-alpha.0",
   "package": "@mastra/mcp",
   "exports": {
     "UnauthorizedError": {

package/dist/index.cjs

@@ -2671,8 +2671,6 @@ var ServerResourceActions = class {
   getSubscriptions;
   getLogger;
   getSdkServer;
-  clearDefinedResources;
-  clearDefinedResourceTemplates;
   /**
    * @internal
    */
@@ -2680,8 +2678,6 @@ var ServerResourceActions = class {
     this.getSubscriptions = dependencies.getSubscriptions;
     this.getLogger = dependencies.getLogger;
     this.getSdkServer = dependencies.getSdkServer;
-    this.clearDefinedResources = dependencies.clearDefinedResources;
-    this.clearDefinedResourceTemplates = dependencies.clearDefinedResourceTemplates;
   }
   /**
    * Notifies subscribed clients that a specific resource has been updated.
@@ -2730,8 +2726,9 @@ var ServerResourceActions = class {
   /**
    * Notifies clients that the overall list of available resources has changed.
    *
-   * This clears the internal resource cache and sends a `notifications/resources/list_changed`
-   * message to all clients, prompting them to re-fetch the resource list.
+   * This sends a `notifications/resources/list_changed` message to all clients, prompting
+   * them to re-fetch the resource list. Resource lists and templates are always evaluated
+   * per request, so there is no server-side cache to clear.
    *
    * @throws {MastraError} If sending the notification fails
    *
@@ -2742,11 +2739,7 @@ var ServerResourceActions = class {
    * ```
    */
   async notifyListChanged() {
-    this.getLogger().info(
-      "Resource list change externally notified. Clearing definedResources and sending notification."
-    );
-    this.clearDefinedResources();
-    this.clearDefinedResourceTemplates();
+    this.getLogger().info("Resource list change externally notified. Sending notification.");
     try {
       await this.getSdkServer().sendResourceListChanged();
     } catch (error$1) {
@@ -2777,9 +2770,11 @@ var MCPServer = class extends mcp.MCPServerBase {
   streamableHTTPTransports = /* @__PURE__ */ new Map();
   // Track server instances for each HTTP session
   httpServerInstances = /* @__PURE__ */ new Map();
-  definedResources;
-  definedResourceTemplates;
   resourceOptions;
+  // Whether any UI (`ui://`) app resources are configured. Captured at construction so
+  // per-request server instances can advertise the MCP Apps extension without relying on
+  // a shared, per-caller resource cache.
+  hasUiResources = false;
   definedPrompts;
   promptOptions;
   jsonSchemaValidator;
@@ -2920,6 +2915,7 @@ var MCPServer = class extends mcp.MCPServerBase {
   constructor(opts) {
     super(opts);
     this.resourceOptions = this.mergeAppResources(opts.resources, opts.appResources);
+    this.hasUiResources = !!opts.appResources && Object.keys(opts.appResources).length > 0;
     this.promptOptions = opts.prompts;
     this.jsonSchemaValidator = opts.jsonSchemaValidator;
     this.mapAuthInfoToUser = opts.mapAuthInfoToUser;
@@ -2965,13 +2961,7 @@ var MCPServer = class extends mcp.MCPServerBase {
     this.resources = new ServerResourceActions({
       getSubscriptions: () => this.subscriptions,
       getLogger: () => this.logger,
-      getSdkServer: () => this.server,
-      clearDefinedResources: () => {
-        this.definedResources = void 0;
-      },
-      clearDefinedResourceTemplates: () => {
-        this.definedResourceTemplates = void 0;
-      }
+      getSdkServer: () => this.server
     });
     this.prompts = new ServerPromptActions({
       getLogger: () => this.logger,
@@ -3130,14 +3120,11 @@ var MCPServer = class extends mcp.MCPServerBase {
     const hasUiTools = Object.values(this.convertedTools).some(
       (tool) => tool.mcp?._meta?.ui?.resourceUri
     );
-    if (hasUiTools || this.resourceOptions) {
-      const hasUiResources = this.definedResources?.some((r) => r.uri.startsWith("ui://"));
-      if (hasUiTools || hasUiResources) {
-        capabilities.extensions = {
-          ...capabilities.extensions,
-          "io.modelcontextprotocol/ui": {}
-        };
-      }
+    if (hasUiTools || this.hasUiResources) {
+      capabilities.extensions = {
+        ...capabilities.extensions,
+        "io.modelcontextprotocol/ui": {}
+      };
     }
     const serverInstance = new index_js$1.Server(
       {
@@ -3354,18 +3341,13 @@ Provided arguments: ${JSON.stringify(request.params.arguments, null, 2)}`
     if (!capturedResourceOptions) return;
     if (capturedResourceOptions.listResources) {
       serverInstance.setRequestHandler(types_js.ListResourcesRequestSchema, async (_request, extra) => {
-        if (this.definedResources) {
-          return { resources: this.definedResources };
-        } else {
-          try {
-            const resources = await capturedResourceOptions.listResources({ extra });
-            this.definedResources = resources;
-            this.logger.debug("Fetched and cached resources", { count: this.definedResources.length });
-            return { resources: this.definedResources };
-          } catch (error) {
-            this.logger.error("Error fetching resources", { error });
-            throw error;
-          }
+        try {
+          const resources = await capturedResourceOptions.listResources({ extra });
+          this.logger.debug("Fetched resources", { count: resources.length });
+          return { resources };
+        } catch (error) {
+          this.logger.error("Error fetching resources", { error });
+          throw error;
         }
       });
     }
@@ -3374,12 +3356,9 @@ Provided arguments: ${JSON.stringify(request.params.arguments, null, 2)}`
         const startTime = Date.now();
         const uri = request.params.uri;
         this.logger.debug("Handling ReadResource request", { uri });
-        if (!this.definedResources) {
-          const resources = await this.resourceOptions?.listResources?.({ extra });
-          if (!resources) throw new Error("Failed to load resources");
-          this.definedResources = resources;
-        }
-        const resource = this.definedResources?.find((r) => r.uri === uri);
+        const resources = await capturedResourceOptions.listResources?.({ extra });
+        if (!resources) throw new Error("Failed to load resources");
+        const resource = resources.find((r) => r.uri === uri);
         if (!resource) {
           this.logger.warn("Unknown resource URI requested", { uri });
           throw new Error(`Resource not found: ${uri}`);
@@ -3419,18 +3398,13 @@ Provided arguments: ${JSON.stringify(request.params.arguments, null, 2)}`
     }
     if (capturedResourceOptions.resourceTemplates) {
       serverInstance.setRequestHandler(types_js.ListResourceTemplatesRequestSchema, async (_request, extra) => {
-        if (this.definedResourceTemplates) {
-          return { resourceTemplates: this.definedResourceTemplates };
-        } else {
-          try {
-            const templates = await capturedResourceOptions.resourceTemplates({ extra });
-            this.definedResourceTemplates = templates;
-            this.logger.debug("Fetched and cached resource templates", { count: this.definedResourceTemplates.length });
-            return { resourceTemplates: this.definedResourceTemplates };
-          } catch (error) {
-            this.logger.error("Error fetching resource templates via resourceTemplates():", { error });
-            throw error;
-          }
+        try {
+          const templates = await capturedResourceOptions.resourceTemplates({ extra });
+          this.logger.debug("Fetched resource templates", { count: templates.length });
+          return { resourceTemplates: templates };
+        } catch (error) {
+          this.logger.error("Error fetching resource templates via resourceTemplates():", { error });
+          throw error;
         }
       });
     }
@@ -4754,11 +4728,7 @@ Provided arguments: ${JSON.stringify(args, null, 2)}`,
       return { resources: [] };
     }
     const extra = {};
-    if (this.definedResources) {
-      return { resources: this.definedResources };
-    }
     const resources = await this.resourceOptions.listResources({ extra });
-    this.definedResources = resources;
     return { resources };
   }
 };