@mastra/mcp 2.8.0-alpha.2 → 2.9.0-alpha.0

package/dist/index.js

@@ -2,7 +2,7 @@ import { createRequire } from "module";
 import { AsyncLocalStorage } from "async_hooks";
 import { MastraBase } from "@mastra/core/base";
 import { ErrorCategory, ErrorDomain, MastraError } from "@mastra/core/error";
-import { createTool, isValidationError, noopObserve, validateToolInput, validateToolOutput } from "@mastra/core/tools";
+import { createTool, getValidationIssuePaths, isValidationError, noopObserve, validateToolInput, validateToolOutput } from "@mastra/core/tools";
 import z3, { ZodFirstPartyTypeKind } from "zod/v3";
 import { toJSONSchema, z } from "zod/v4";
 import { z as z$1 } from "zod";
@@ -30,101 +30,6 @@ import { SignalProvider } from "@mastra/core/signals";
 // src/client/types.ts
 /** The current protocol revision; the one `/mcp` servers speak. */
 const MCP_CLIENT_PROTOCOL_VERSION = "2026-07-28";
-// ../schema-compat/dist/json-schema-traverse-D0CId4oM.js
-var __create$1 = Object.create;
-var __defProp$2 = Object.defineProperty;
-var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames$1 = Object.getOwnPropertyNames;
-var __getProtoOf$1 = Object.getPrototypeOf;
-var __hasOwnProp$1 = Object.prototype.hasOwnProperty;
-var __commonJSMin$1 = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod, mod.exports), cb = null), mod.exports);
-var __copyProps$1 = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames$1(from), i = 0, n = keys.length, key; i < n; i++) {
-		key = keys[i];
-		if (!__hasOwnProp$1.call(to, key) && key !== except) __defProp$2(to, key, {
-			get: ((k) => from[k]).bind(null, key),
-			enumerable: !(desc = __getOwnPropDesc$1(from, key)) || desc.enumerable
-		});
-	}
-	return to;
-};
-var __toESM$1 = (mod, isNodeMode, target) => (target = mod != null ? __create$1(__getProtoOf$1(mod)) : {}, __copyProps$1(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp$1.call(mod, "default") ? __defProp$2(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
-var require_json_schema_traverse = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
-	var traverse = module.exports = function(schema, opts, cb) {
-		if (typeof opts == "function") {
-			cb = opts;
-			opts = {};
-		}
-		cb = opts.cb || cb;
-		var pre = typeof cb == "function" ? cb : cb.pre || function() {};
-		var post = cb.post || function() {};
-		_traverse(opts, pre, post, schema, "", schema);
-	};
-	traverse.keywords = {
-		additionalItems: true,
-		items: true,
-		contains: true,
-		additionalProperties: true,
-		propertyNames: true,
-		not: true,
-		if: true,
-		then: true,
-		else: true
-	};
-	traverse.arrayKeywords = {
-		items: true,
-		allOf: true,
-		anyOf: true,
-		oneOf: true
-	};
-	traverse.propsKeywords = {
-		$defs: true,
-		definitions: true,
-		properties: true,
-		patternProperties: true,
-		dependencies: true
-	};
-	traverse.skipKeywords = {
-		default: true,
-		enum: true,
-		const: true,
-		required: true,
-		maximum: true,
-		minimum: true,
-		exclusiveMaximum: true,
-		exclusiveMinimum: true,
-		multipleOf: true,
-		maxLength: true,
-		minLength: true,
-		pattern: true,
-		format: true,
-		maxItems: true,
-		minItems: true,
-		uniqueItems: true,
-		maxProperties: true,
-		minProperties: true
-	};
-	function _traverse(opts, pre, post, schema, jsonPtr, rootSchema, parentJsonPtr, parentKeyword, parentSchema, keyIndex) {
-		if (schema && typeof schema == "object" && !Array.isArray(schema)) {
-			pre(schema, jsonPtr, rootSchema, parentJsonPtr, parentKeyword, parentSchema, keyIndex);
-			for (var key in schema) {
-				var sch = schema[key];
-				if (Array.isArray(sch)) {
-					if (key in traverse.arrayKeywords) for (var i = 0; i < sch.length; i++) _traverse(opts, pre, post, sch[i], jsonPtr + "/" + key + "/" + i, rootSchema, jsonPtr, key, schema, i);
-				} else if (key in traverse.propsKeywords) {
-					if (sch && typeof sch == "object") for (var prop in sch) _traverse(opts, pre, post, sch[prop], jsonPtr + "/" + key + "/" + escapeJsonPtr(prop), rootSchema, jsonPtr, key, schema, prop);
-				} else if (key in traverse.keywords || opts.allKeys && !(key in traverse.skipKeywords)) _traverse(opts, pre, post, sch, jsonPtr + "/" + key, rootSchema, jsonPtr, key, schema);
-			}
-			post(schema, jsonPtr, rootSchema, parentJsonPtr, parentKeyword, parentSchema, keyIndex);
-		}
-	}
-	function escapeJsonPtr(str) {
-		return str.replace(/~/g, "~0").replace(/\//g, "~1");
-	}
-}));
 // ../schema-compat/dist/esm-BG70JlG8.js
 const ignoreOverride$1 = Symbol("Let zodToJsonSchema decide on which parser to use");
 const defaultOptions$1 = {
@@ -1330,6 +1235,101 @@ var AiSdkSchemaWrapper = class {
 function toStandardSchema$4(schema) {
 	return new AiSdkSchemaWrapper(schema);
 }
+// ../schema-compat/dist/json-schema-traverse-D0CId4oM.js
+var __create$1 = Object.create;
+var __defProp$2 = Object.defineProperty;
+var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames$1 = Object.getOwnPropertyNames;
+var __getProtoOf$1 = Object.getPrototypeOf;
+var __hasOwnProp$1 = Object.prototype.hasOwnProperty;
+var __commonJSMin$1 = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod, mod.exports), cb = null), mod.exports);
+var __copyProps$1 = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames$1(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp$1.call(to, key) && key !== except) __defProp$2(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc$1(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM$1 = (mod, isNodeMode, target) => (target = mod != null ? __create$1(__getProtoOf$1(mod)) : {}, __copyProps$1(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp$1.call(mod, "default") ? __defProp$2(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+var require_json_schema_traverse = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
+	var traverse = module.exports = function(schema, opts, cb) {
+		if (typeof opts == "function") {
+			cb = opts;
+			opts = {};
+		}
+		cb = opts.cb || cb;
+		var pre = typeof cb == "function" ? cb : cb.pre || function() {};
+		var post = cb.post || function() {};
+		_traverse(opts, pre, post, schema, "", schema);
+	};
+	traverse.keywords = {
+		additionalItems: true,
+		items: true,
+		contains: true,
+		additionalProperties: true,
+		propertyNames: true,
+		not: true,
+		if: true,
+		then: true,
+		else: true
+	};
+	traverse.arrayKeywords = {
+		items: true,
+		allOf: true,
+		anyOf: true,
+		oneOf: true
+	};
+	traverse.propsKeywords = {
+		$defs: true,
+		definitions: true,
+		properties: true,
+		patternProperties: true,
+		dependencies: true
+	};
+	traverse.skipKeywords = {
+		default: true,
+		enum: true,
+		const: true,
+		required: true,
+		maximum: true,
+		minimum: true,
+		exclusiveMaximum: true,
+		exclusiveMinimum: true,
+		multipleOf: true,
+		maxLength: true,
+		minLength: true,
+		pattern: true,
+		format: true,
+		maxItems: true,
+		minItems: true,
+		uniqueItems: true,
+		maxProperties: true,
+		minProperties: true
+	};
+	function _traverse(opts, pre, post, schema, jsonPtr, rootSchema, parentJsonPtr, parentKeyword, parentSchema, keyIndex) {
+		if (schema && typeof schema == "object" && !Array.isArray(schema)) {
+			pre(schema, jsonPtr, rootSchema, parentJsonPtr, parentKeyword, parentSchema, keyIndex);
+			for (var key in schema) {
+				var sch = schema[key];
+				if (Array.isArray(sch)) {
+					if (key in traverse.arrayKeywords) for (var i = 0; i < sch.length; i++) _traverse(opts, pre, post, sch[i], jsonPtr + "/" + key + "/" + i, rootSchema, jsonPtr, key, schema, i);
+				} else if (key in traverse.propsKeywords) {
+					if (sch && typeof sch == "object") for (var prop in sch) _traverse(opts, pre, post, sch[prop], jsonPtr + "/" + key + "/" + escapeJsonPtr(prop), rootSchema, jsonPtr, key, schema, prop);
+				} else if (key in traverse.keywords || opts.allKeys && !(key in traverse.skipKeywords)) _traverse(opts, pre, post, sch, jsonPtr + "/" + key, rootSchema, jsonPtr, key, schema);
+			}
+			post(schema, jsonPtr, rootSchema, parentJsonPtr, parentKeyword, parentSchema, keyIndex);
+		}
+	}
+	function escapeJsonPtr(str) {
+		return str.replace(/~/g, "~0").replace(/\//g, "~1");
+	}
+}));
 // ../schema-compat/dist/json-schema-BdCwqjfN.js
 var require_code$1 = /* @__PURE__ */ __commonJSMin$1(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
@@ -15951,6 +15951,50 @@ function runOutsideDatadogTraceScope(callback) {
 	if (!scope) return callback();
 	return scope.activate(null, callback);
 }
+const LOGGABLE_ERROR_NAMES = /* @__PURE__ */ new Set([
+	"Error",
+	"TypeError",
+	"RangeError",
+	"SyntaxError",
+	"AbortError",
+	"TimeoutError",
+	"McpError",
+	"ProtocolError",
+	"SdkError",
+	"SdkHttpError",
+	"SseError",
+	"StreamableHTTPError",
+	"UnauthorizedError",
+	"OAuthError",
+	"UnsupportedProtocolVersionError"
+]);
+const LOGGABLE_ERROR_CODES = /* @__PURE__ */ new Set([
+	"ECONNRESET",
+	"ECONNREFUSED",
+	"ECONNABORTED",
+	"ETIMEDOUT",
+	"ENOTFOUND",
+	"EPIPE",
+	"EAI_AGAIN",
+	"ABORT_ERR",
+	"UND_ERR_SOCKET",
+	"UND_ERR_CONNECT_TIMEOUT",
+	"UND_ERR_HEADERS_TIMEOUT",
+	"UND_ERR_BODY_TIMEOUT"
+]);
+/**
+* Names a tool-call failure for logs without its message: server error text can echo the submitted
+* arguments back (Issue #29318). The full error still reaches the caller.
+*/
+function errorKind(error) {
+	if (error instanceof MastraError) return error.id;
+	if (error instanceof Error) {
+		const name = LOGGABLE_ERROR_NAMES.has(error.name) ? error.name : "Error";
+		const code = error.code;
+		return typeof code === "number" || typeof code === "string" && LOGGABLE_ERROR_CODES.has(code) ? `${name} (${code})` : name;
+	}
+	return typeof error;
+}
 /**
 * Convert an MCP LoggingLevel to a logger method name that exists in our logger
 */
@@ -17097,10 +17141,7 @@ var InternalMastraMCPClient = class extends MastraBase {
 								});
 								return res && finishToolCall(res);
 							}
-							this.log("debug", `Executing tool: ${tool.name}`, {
-								toolArgs: input,
-								runId: context?.runId
-							});
+							this.log("debug", `Executing tool: ${tool.name}`, { runId: context?.runId });
 							const progressMeta = this.enableProgressTracking ? { progressToken: context?.runId || crypto.randomUUID() } : void 0;
 							const _meta = this.requestMeta({
 								...context?._meta,
@@ -17129,7 +17170,7 @@ var InternalMastraMCPClient = class extends MastraBase {
 						const finishToolCall = async (res) => {
 							if (res.isError && this.onToolError === "throw") {
 								const errorText = extractToolErrorText(res.content);
-								this.log("debug", `Tool reported an error: ${tool.name}`, { error: errorText });
+								this.log("debug", `Tool reported an error: ${tool.name}`);
 								throw new MastraError({
 									id: "MCP_CLIENT_TOOL_EXECUTION_FAILED",
 									domain: ErrorDomain.MCP,
@@ -17148,7 +17189,7 @@ var InternalMastraMCPClient = class extends MastraBase {
 									const validationSchema = await getOutputValidationSchema();
 									const validation = validateToolOutput(validationSchema, res.structuredContent, tool.name);
 									if (validation.error) {
-										this.log("debug", `Tool output failed schema validation: ${tool.name}`, { message: validation.error.message });
+										this.log("debug", `Tool output failed schema validation: ${tool.name}`, { issuePaths: getValidationIssuePaths(validation.error, validationSchema, "output") });
 										return validation.error;
 									}
 								}
@@ -17162,24 +17203,20 @@ var InternalMastraMCPClient = class extends MastraBase {
 							return await executeToolCall();
 						} catch (e) {
 							if (!(e instanceof MastraError && (e.id === "MCP_CLIENT_TOOL_EXECUTION_FAILED" || e.id.startsWith("MCP_CLIENT_TOOL_TASK_"))) && isReconnectableMCPError(e)) {
-								this.log("debug", `Transport error detected for tool ${tool.name}, attempting reconnection...`, { error: e instanceof Error ? e.message : String(e) });
+								this.log("debug", `Transport error detected for tool ${tool.name}, attempting reconnection...`, { error: errorKind(e) });
 								try {
 									await this.reconnectAfterTransportFailure(failedTransport, lifecycleGeneration);
 									this.log("debug", `Retrying tool ${tool.name} after reconnection...`);
 									return await executeToolCall();
 								} catch (reconnectError) {
 									this.log("error", `Reconnection or retry failed for tool ${tool.name}`, {
-										originalError: e instanceof Error ? e.message : String(e),
-										reconnectError: reconnectError instanceof Error ? reconnectError.stack : String(reconnectError),
-										toolArgs: input
+										originalError: errorKind(e),
+										reconnectError: errorKind(reconnectError)
 									});
 									throw reconnectError;
 								}
 							}
-							this.log("error", `Error calling tool: ${tool.name}`, {
-								error: e instanceof Error ? e.stack : JSON.stringify(e, null, 2),
-								toolArgs: input
-							});
+							this.log("error", `Error calling tool: ${tool.name}`, { error: errorKind(e) });
 							throw e;
 						}
 					});
@@ -18981,7 +19018,7 @@ onListChanged: async (serverName, handler) => {
 		const errors = {};
 		const errorDetails = {};
 		const durations = {};
-		const settled = await this.discoverAcrossServers((serverName) => this.getToolsForServer(serverName), {
+		const settled = await this.discoverAcrossServers(async (serverName) => modelVisibleTools(await this.getToolsForServer(serverName)), {
 			errorId: "MCP_CLIENT_GET_TOOLS_FAILED",
 			logMessage: "Failed to list tools from server:"
 		}, options);
@@ -19036,7 +19073,7 @@ onListChanged: async (serverName, handler) => {
 		const errors = {};
 		const errorDetails = {};
 		const durations = {};
-		const settled = await this.discoverAcrossServers((serverName) => this.getToolsForServer(serverName), {
+		const settled = await this.discoverAcrossServers(async (serverName) => modelVisibleTools(await this.getToolsForServer(serverName)), {
 			errorId: "MCP_CLIENT_GET_TOOLSETS_FAILED",
 			logMessage: "Failed to list toolsets from server:"
 		}, options);
@@ -19100,7 +19137,7 @@ onListChanged: async (serverName, handler) => {
 		const errorDetails = {};
 		const durations = {};
 		const settled = await this.discoverAcrossServers(async (serverName) => {
-			return (await this.getConnectedClientForServer(serverName)).toolDefinitions();
+			return modelVisibleDefinitions(await (await this.getConnectedClientForServer(serverName)).toolDefinitions());
 		}, {
 			errorId: "MCP_CLIENT_GET_TOOL_DEFINITIONS_FAILED",
 			logMessage: "Failed to list tool definitions from server:"
@@ -19169,7 +19206,7 @@ onListChanged: async (serverName, handler) => {
 				this.logger.warn("Skipping cached MCP tool definitions for a server that is no longer configured", { serverName });
 				continue;
 			}
-			for (const [toolName, definition] of Object.entries(definitions)) try {
+			for (const [toolName, definition] of Object.entries(modelVisibleDefinitions(definitions))) try {
 				tools[`${serverName}_${toolName}`] = await this.toolFromDefinition({
 					serverName,
 					definition
@@ -19437,6 +19474,22 @@ onListChanged: async (serverName, handler) => {
 		return {};
 	}
 };
+/**
+* Whether a tool may be handed to the model. MCP App servers mark helpers their app calls itself
+* with `_meta.ui.visibility` lacking `'model'`; per the MCP Apps spec, hosts must not give those
+* to the model. They stay callable by the app through the server.
+*/
+function isModelVisible(meta) {
+	const ui = meta?.ui;
+	const visibility = ui && typeof ui === "object" && "visibility" in ui ? ui.visibility : void 0;
+	return !Array.isArray(visibility) || visibility.includes("model");
+}
+function modelVisibleTools(tools) {
+	return Object.fromEntries(Object.entries(tools).filter(([, tool]) => isModelVisible(tool.mcp?._meta)));
+}
+function modelVisibleDefinitions(definitions) {
+	return Object.fromEntries(Object.entries(definitions).filter(([, definition]) => isModelVisible(definition._meta)));
+}
 // src/server/actions.ts
 /** Runtime tool catalogue mutations. Every change is published to listening clients. */
 var ServerToolActions = class {
@@ -19568,8 +19621,17 @@ function callerTrace(ctx) {
 	return callerTraceContext(meta?.traceparent, meta?.tracestate) ?? callerTraceContext(headers?.get("traceparent"), headers?.get("tracestate"));
 }
 /**
+* Where `@mastra/server` attaches, on `req.auth`, the request context its auth
+* resolved (user, permissions, roles, resource id, tenant, auth mode). A symbol
+* cannot come out of a token or JSON payload, so only server code can supply it.
+*/
+const MCP_TRUSTED_REQUEST_CONTEXT = Symbol.for("mastra.mcp.trustedRequestContext");
+const MASTRA_USER_KEY = "mastra__user";
+/**
 * Builds the trusted application context for one request. Auth is re-derived from
-* the transport every time; nothing is carried between continuation rounds. The W3C
+* the transport every time; nothing is carried between continuation rounds. When
+* the request came through a Mastra server route, the values its auth resolved are
+* copied in, so tools are authorized the same way as that server's routes. The W3C
 * trace fields sent by the client are exposed under `traceContext` as opaque
 * strings for observability only; they are never consulted for authorization.
 */
@@ -19579,6 +19641,12 @@ async function toRequestContext(ctx, mapAuthInfoToUser) {
 	if (traceContext) requestContext.set("traceContext", traceContext);
 	const authInfo = ctx.http?.authInfo;
 	if (!authInfo) return requestContext;
+	const trusted = authInfo[MCP_TRUSTED_REQUEST_CONTEXT];
+	if (trusted && typeof trusted === "object") {
+		for (const [key, value] of Object.entries(trusted)) requestContext.set(key, value);
+		const trustedUser = trusted[MASTRA_USER_KEY];
+		if (trustedUser) requestContext.set("user", trustedUser);
+	}
 	requestContext.set("authInfo", authInfo);
 	const user = await mapAuthInfoToUser?.({
 		authInfo,
@@ -22781,6 +22849,17 @@ function toSummary(listing) {
 function isWorkflowTaskContext(context) {
 	return context?.kind === "workflow" && typeof context.runId === "string" && typeof context.workflowKey === "string";
 }
+/**
+* A run's result with its step results read: a storage v2 result's `steps` is a loader that reads
+* them from storage, so a view, and the text a tool answers with, gets them as for v1.
+*/
+async function withLoadedSteps(result) {
+	const steps = result.steps;
+	return typeof steps === "function" ? {
+		...result,
+		steps: await steps()
+	} : result;
+}
 /** Statuses a run never leaves. */
 const FINAL_STATUSES = /* @__PURE__ */ new Set([
 	"success",
@@ -23050,11 +23129,11 @@ var MCPServer = class extends MCPServerBase {
 				inputSchema: workflow.inputSchema,
 				mcp: { toolType: "workflow" },
 				execute: async (inputData, context) => {
-					return (await workflow.createRun({ runId: context?.requestContext?.get("runId") })).start({
+					return withLoadedSteps(await (await workflow.createRun({ runId: context?.requestContext?.get("runId") })).start({
 						inputData,
 						requestContext: context?.requestContext,
 						tracingContext: context?.tracingContext
-					});
+					}));
 				}
 			}));
 		}
@@ -23844,7 +23923,7 @@ var MCPServer = class extends MCPServerBase {
 		if (!workflow) throw new Error(`Workflow '${workflowKey}' is not served`);
 		const input = validateToolInput(workflow.inputSchema, args, name);
 		if (input.error) {
-			this.logger.warn(`Tool '${name}' rejected its input.`, { error: input.error.message });
+			this.logger.warn(`Tool '${name}' rejected its input.`, { issuePaths: getValidationIssuePaths(input.error, workflow.inputSchema) });
 			return errorResult$1(input.error.message);
 		}
 		const context = {
@@ -23867,11 +23946,11 @@ var MCPServer = class extends MCPServerBase {
 		};
 		const start = (runTracing) => {
 			const run = workflow.createRun({ runId: context.runId });
-			const result = run.then((started) => started.start({
+			const result = run.then(async (started) => withLoadedSteps(await started.start({
 				inputData: input.data,
 				requestContext,
 				tracingContext: runTracing
-			}));
+			})));
 			const cancel = () => void run.then((started) => started.cancel()).catch((error) => this.logger.warn("Could not cancel workflow run", {
 				tool: name,
 				error
@@ -24000,12 +24079,12 @@ var MCPServer = class extends MCPServerBase {
 			error
 		})));
 		try {
-			view = await run.resume({
+			view = await withLoadedSteps(await run.resume({
 				step: answered.step,
 				resumeData: answer.content ?? {},
 				requestContext,
 				...span && { tracingContext: { currentSpan: span } }
-			});
+			}));
 		} catch (error) {
 			if (isResumeClaimLost(error)) return this.watchWorkflowRun(workflow, context, attempt.signal);
 			const now = await workflow.getWorkflowRunById(context.runId, { withNestedWorkflows: false });
@@ -24173,7 +24252,7 @@ var MCPServer = class extends MCPServerBase {
 	}
 	toCallToolResult(name, tool, value) {
 		if (isValidationError(value)) {
-			this.logger.warn(`Tool '${name}' rejected its input.`, { error: value.message });
+			this.logger.warn(`Tool '${name}' rejected its input.`, { issuePaths: getValidationIssuePaths(value, tool.parameters) });
 			return errorResult$1(value.message);
 		}
 		const resourceUri = uiResourceUri(tool.mcp?._meta);
@@ -24618,10 +24697,7 @@ var MCPServer = class extends MCPServerBase {
 					id: "MCP_SERVER_TOOL_EXECUTE_FAILED",
 					domain: ErrorDomain.MCP,
 					category: ErrorCategory.USER,
-					details: {
-						toolId,
-						args: JSON.stringify(args)
-					}
+					details: { toolId }
 				}, error);
 				this.logger.trackException(mastraError);
 				throw mastraError;