@mastra/mcp 2.4.1-alpha.0 → 2.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/client/client.d.ts.map +1 -1
- package/dist/docs/SKILL.md +1 -1
- package/dist/docs/assets/SOURCE_MAP.json +1 -1
- package/dist/docs/references/docs-connections-mcp.md +2 -0
- package/dist/docs/references/docs-guides-mcp-authentication-authorization.md +10 -1
- package/dist/docs/references/reference-tools-mcp-server.md +1 -1
- package/dist/index.cjs +6 -3
- package/dist/index.cjs.map +1 -1
- package/dist/index.js +6 -3
- package/dist/index.js.map +1 -1
- package/package.json +9 -9
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAK/C,OAAO,KAAK,EAAmB,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAShE,OAAO,KAAK,EAEV,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,2BAA2B,EAG3B,kBAAkB,EAMnB,MAAM,8BAA8B,CAAC;AAOtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAI3D,OAAO,KAAK,EAGV,eAAe,EAEf,8BAA8B,EAE9B,uBAAuB,EAEvB,6BAA6B,EAC9B,MAAM,SAAS,CAAC;AAIjB,YAAY,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,eAAe,EACf,eAAe,EACf,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,sBAAsB,EACtB,8BAA8B,EAC9B,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,SAAS,CAAC;AA8FjB;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client/client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAK/C,OAAO,KAAK,EAAmB,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAShE,OAAO,KAAK,EAEV,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,2BAA2B,EAG3B,kBAAkB,EAMnB,MAAM,8BAA8B,CAAC;AAOtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAI3D,OAAO,KAAK,EAGV,eAAe,EAEf,8BAA8B,EAE9B,uBAAuB,EAEvB,6BAA6B,EAC9B,MAAM,SAAS,CAAC;AAIjB,YAAY,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,eAAe,EACf,eAAe,EACf,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,eAAe,EACf,sBAAsB,EACtB,8BAA8B,EAC9B,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,SAAS,CAAC;AA8FjB;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,YAAY,CAAC;AAgE7D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,eAA2C,CAAC;AAE9E,uFAAuF;AACvF,eAAO,MAAM,kBAAkB,eAAwC,CAAC;AAwBxE;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAG9D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAGvF;AAuGD;;;;;;;;;;;GAWG;AACH,qBAAa,uBAAwB,SAAQ,UAAU;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAe;IAC/C,OAAO,CAAC,sBAAsB,CAAU;IACxC,OAAO,CAAC,YAAY,CAA4B;IAChD,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,oBAAoB,CAAC,CAAgC;IAC7D,OAAO,CAAC,iBAAiB,CAAC,CAAa;IACvC,OAAO,CAAC,uBAAuB,CAAC,CAAa;IAC7C,OAAO,CAAC,UAAU,CAAC,CAAqB;IACxC,OAAO,CAAC,qBAAqB,CAAkD;IAC/E,OAAO,CAAC,mBAAmB,CAAC,CAAa;IACzC,OAAO,CAAC,cAAc,CAAC,CAAa;IACpC,OAAO,CAAC,aAAa,CAAC,CAAa;IACnC,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC,OAAO,CAAC,oBAAoB,CAAC,CAA0B;IACvD,8EAA8E;IAC9E,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAkC;IACtE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,mBAAmB,CAAC,CAAsB;IAClD,OAAO,CAAC,0BAA0B,CAAC,CAA+B;IAElE,yEAAyE;IACzE,SAAgB,SAAS,EAAE,qBAAqB,CAAC;IACjD,sEAAsE;IACtE,SAAgB,OAAO,EAAE,mBAAmB,CAAC;IAC7C,6DAA6D;IAC7D,SAAgB,QAAQ,EAAE,qBAAqB,CAAC;IAEhD;;OAEG;IACH,YAAY,EACV,IAAI,EACJ,OAAiB,EACjB,UAAU,EACV,MAAM,EACN,OAAsC,GACvC,EAAE,8BAA8B,EAyDhC;IAED;;OAEG;IACH,OAAO,CAAC,GAAG;IAkBX;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,aAAa;YAiBP,YAAY;YA6BZ,WAAW;IAgEzB;;;;;;;;OAQG;YACW,0BAA0B;IAsBxC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAWhC;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAQjC;;;OAGG;IACH,OAAO,CAAC,aAAa;IAMrB;;;;OAIG;IACH,IAAI,SAAS,IAAI,kBAAkB,GAAG,SAAS,CAE9C;IAED;;;;;;;;;OASG;IACG,UAAU,CAAC,iBAAiB,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAY1E;IAED,OAAO,CAAC,WAAW,CAAiC;IACpD,OAAO,CAAC,gBAAgB,CAA8B;IAEtD;;;;OAIG;IACH,OAAO,CAAC,oBAAoB,CAK1B;IACF,OAAO,CAAC,kBAAkB,CAAC,CAAkB;IAC7C,OAAO,CAAC,kBAAkB,CAAuC;IACjE,OAAO,CAAC,mBAAmB,CAAK;IAEhC;;;;;;OAMG;IACG,OAAO,qBAmFZ;IAED;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAsB5B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAe9B;;;;OAIG;IACH,IAAI,MAAM,IAAI,MAAM,GAAG,IAAI,CAK1B;IAED,IAAI,YAAY,IAAI,MAAM,GAAG,SAAS,CAErC;IAED,gIAAgI;IAChI,IAAI,UAAU,IAAI,uBAAuB,GAAG,SAAS,CAEpD;IAED,qFAAqF;IACrF,IAAI,yBAAyB,IAAI,MAAM,GAAG,SAAS,CAElD;IAED,OAAO,CAAC,mBAAmB;IAQ3B,uGAAuG;IACvG,OAAO,CAAC,qBAAqB;IAS7B,IAAI,mBAAmB,IAAI,OAAO,CAEjC;IAED,IAAI,qBAAqB,IAAI,MAAM,CAElC;IAEK,UAAU,kBAuCf;IAED;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CA+CpC;YAEa,8BAA8B;IA0BtC,aAAa,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAGlD;IAEK,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAG3D;IAEK,qBAAqB,IAAI,OAAO,CAAC,2BAA2B,CAAC,CAGlE;IAED;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAG9C;IAED;;OAEG;IACG,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAMtG;IAED,OAAO,CAAC,uBAAuB;IAU/B,OAAO,CAAC,kBAAkB;IAY1B,6EAA6E;IAC7E,OAAO,CAAC,yBAAyB;IAMjC;;;;;OAKG;YACW,yBAAyB;YA2BzB,uBAAuB;IAOrC,kGAAkG;YACpF,yBAAyB;IAKvC;;;OAGG;IACG,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQlD;IAEK,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQpD;YAEa,2BAA2B;IAYnC,uCAAuC,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhF;IAEK,qCAAqC,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAM9E;IAED,qCAAqC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,IAAI,CAItF;IAEK,yCAAyC,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAMlF;IAED,8BAA8B,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAI7D;YAEa,sBAAsB;IAUpC,OAAO,CAAC,kBAAkB;IAK1B;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC,CAU9E;IAED,OAAO,CAAC,wBAAwB;IAoBhC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,UAAU,EAAE,EAAE;QAAE,UAAU,EAAE,6BAA6B,CAAA;KAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CA4B1G;IAEK,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAiB/D;IAED;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IA+P9B,OAAO,CAAC,mBAAmB;CAQ5B"}
|
package/dist/docs/SKILL.md
CHANGED
|
@@ -8,6 +8,8 @@ Mastra supports the [Model Context Protocol (MCP)](https://modelcontextprotocol.
|
|
|
8
8
|
|
|
9
9
|
Use [`MCPClient`](https://mastra.ai/reference/tools/mcp-client) to connect to MCP servers. Use [`MCPServer`](https://mastra.ai/reference/tools/mcp-server) to expose Mastra agents, tools, workflows, prompts, and resources to other MCP-compatible systems. Both speak the MCP `2026-07-28` revision over stdio and Streamable HTTP.
|
|
10
10
|
|
|
11
|
+
For hosted MCP servers such as Neon and Canva, [Connect](https://mastra.ai/docs/mastra-platform/connect/providers) on Mastra platform can manage the OAuth flow and credentials for you, so agents get the server's tools through [`tools()`](https://mastra.ai/docs/mastra-platform/connect/tools) without a hand-configured `MCPClient`.
|
|
12
|
+
|
|
11
13
|
> **Note:** Upgrading from `@mastra/mcp` 1.x? See the [migration guide](https://mastra.ai/reference/migrations/mcp-v2).
|
|
12
14
|
|
|
13
15
|
For credential choices and permission boundaries, see [Authentication and authorization with MCP](https://mastra.ai/docs/guides/mcp-authentication-authorization).
|
|
@@ -93,6 +93,14 @@ Configure validation appropriate to your issuer, including audience and expiry c
|
|
|
93
93
|
|
|
94
94
|
Protecting Mastra routes with `server.auth` and providing interoperable OAuth discovery are different tasks. Don't assume configuring one supplies the other.
|
|
95
95
|
|
|
96
|
+
### Routes Mastra registers for an MCP server
|
|
97
|
+
|
|
98
|
+
Alongside the MCP transport, Mastra registers REST routes used by Studio to list servers, inspect tools, execute tools, and read resources. See the [MCP routes reference](https://mastra.ai/reference/server/routes) for the full list. These paths use the default `/api` prefix.
|
|
99
|
+
|
|
100
|
+
The `POST /api/mcp/:serverId/tools/:toolId/execute` route calls `executeTool()` directly, without a protocol client. With a Mastra FGA provider configured, `MCPServer.executeTool()` enforces tool execution permission using the user in `requestContext`. The REST tool list also filters tools through FGA. These permission checks don't replace route authentication.
|
|
101
|
+
|
|
102
|
+
Built-in authentication for these routes depends on `server.auth`. Without it, `requiresAuth: true` doesn't enforce authentication. Custom middleware that checks only the `/mcp` or `/sse` transport paths leaves the REST routes open. If you use custom middleware instead of `server.auth`, default-deny `/api/mcp/*` and allow access only after authentication.
|
|
103
|
+
|
|
96
104
|
### Pass verified identity to tools
|
|
97
105
|
|
|
98
106
|
When a Mastra server handles an MCP request, its auth bridge preserves an existing `req.auth`. Otherwise, it uses `server.mcpOptions.setRequestAuth` when configured, or builds `authInfo` from the request context. With the default bridge, the authenticated user is available in `authInfo.extra.user`.
|
|
@@ -121,9 +129,10 @@ Keep access tokens, refresh tokens, and service credentials outside model-visibl
|
|
|
121
129
|
|
|
122
130
|
- [ ] **Validate tokens:** Configure validation for your issuer, including audience and expiry checks, and confirm an unvalidated token is rejected.
|
|
123
131
|
- [ ] **Challenge missing tokens:** Confirm every protected server path returns `401` without a bearer token.
|
|
132
|
+
- [ ] **Protect MCP REST routes:** If you don't use `server.auth`, confirm `/api/mcp/:serverId/tools*`, `/api/mcp/:serverId/resources*`, and `/api/mcp/v0/servers*` aren't reachable without authentication. Use your configured API prefix if it differs from `/api`.
|
|
124
133
|
- [ ] **Isolate users:** Confirm one user's provider, connection, and stored credentials aren't reused for another user.
|
|
125
134
|
- [ ] **Bind credentials to the issuer:** Confirm registration and tokens aren't reused when the authorization server changes.
|
|
126
|
-
- [ ] **Deny unauthorized operations:** Confirm a caller without permission is denied `tools/call`, including for a tool it never listed.
|
|
135
|
+
- [ ] **Deny unauthorized operations:** Confirm a caller without permission is denied both `tools/call` and `POST /api/mcp/:serverId/tools/:toolId/execute`, including for a tool it never listed.
|
|
127
136
|
- [ ] **Scope records to the caller:** Confirm record lookups resolve the tenant from trusted server context rather than tool arguments.
|
|
128
137
|
- [ ] **Keep tokens at their audience:** Confirm upstream calls use separate credentials and never forward the MCP token.
|
|
129
138
|
- [ ] **Keep secrets out of model data:** Confirm tokens and credentials stay out of instructions, tool arguments, and tool results.
|
|
@@ -456,7 +456,7 @@ getToolInfo(toolId: string): ToolInfo | undefined
|
|
|
456
456
|
|
|
457
457
|
### `executeTool()`
|
|
458
458
|
|
|
459
|
-
Runs a tool without a protocol client, which is how the Mastra REST route `POST /api/mcp/:serverId/tools/:toolId/execute` and Studio invoke tools.
|
|
459
|
+
Runs a tool without a protocol client, which is how the Mastra REST route `POST /api/mcp/:serverId/tools/:toolId/execute` and Studio invoke tools. See [authentication for registered MCP routes](https://mastra.ai/docs/guides/mcp-authentication-authorization) and the [MCP routes reference](https://mastra.ai/reference/server/routes).
|
|
460
460
|
|
|
461
461
|
```typescript
|
|
462
462
|
async executeTool(
|
package/dist/index.cjs
CHANGED
|
@@ -23533,9 +23533,12 @@ function extractToolErrorText(content) {
|
|
|
23533
23533
|
*/
|
|
23534
23534
|
function extractModelTextFromToolContent(content) {
|
|
23535
23535
|
if (!Array.isArray(content)) return void 0;
|
|
23536
|
-
return content.
|
|
23537
|
-
|
|
23538
|
-
|
|
23536
|
+
return content.map((part) => {
|
|
23537
|
+
if (!part || typeof part !== "object") return void 0;
|
|
23538
|
+
const p = part;
|
|
23539
|
+
if (p.type === "text" && typeof p.text === "string") return p.text;
|
|
23540
|
+
if (p.type === "resource" && typeof p.resource?.text === "string") return p.resource.text;
|
|
23541
|
+
}).filter((t) => t !== void 0).join("\n").trim() || void 0;
|
|
23539
23542
|
}
|
|
23540
23543
|
/**
|
|
23541
23544
|
* Non-enumerable metadata attached to structured tool execute results so
|