@mcp-ts/sdk 2.4.4 → 2.5.0

package/dist/{tool-router-DQ-HrD7W.d.ts → tool-router-CS9l0w4a.d.ts}

@@ -1,5 +1,5 @@
 import { Tool } from '@modelcontextprotocol/sdk/types.js';
-import { A as ToolClientProvider, T as ToolClient } from './types-Bf-7GOLW.js';
+import { A as ToolClientProvider, T as ToolClient } from './types-DK_NGWd4.js';
 
 /**
  * ToolIndex — Lightweight in-memory search index for MCP tool discovery.

package/dist/{tool-router-CGs3IDOJ.d.mts → tool-router-CVLBaCwH.d.mts}

@@ -1,5 +1,5 @@
 import { Tool } from '@modelcontextprotocol/sdk/types.js';
-import { A as ToolClientProvider, T as ToolClient } from './types-Bf-7GOLW.mjs';
+import { A as ToolClientProvider, T as ToolClient } from './types-DK_NGWd4.mjs';
 
 /**
  * ToolIndex — Lightweight in-memory search index for MCP tool discovery.

package/dist/{types-Bf-7GOLW.d.mts → types-DK_NGWd4.d.mts}

@@ -138,6 +138,7 @@ interface ToolClient {
     callTool(name: string, args: Record<string, unknown>): Promise<any>;
     getServerId?(): string | undefined;
     getServerName?(): string | undefined;
+    getServerUrl?(): string | undefined;
     getSessionId?(): string;
 }
 /**
@@ -203,7 +204,13 @@ type ToolInfo = {
 };
 type TransportType = 'sse' | 'streamable-http';
 type SessionStatus = 'pending' | 'active';
-type McpRpcMethod = 'connect' | 'disconnect' | 'listTools' | 'callTool' | 'listSessions' | 'getSession' | 'finishAuth' | 'listPrompts' | 'getPrompt' | 'listResources' | 'readResource';
+type ToolPolicyMode = 'all' | 'allowlist' | 'denylist';
+interface ToolPolicy {
+    mode: ToolPolicyMode;
+    toolIds: string[];
+    updatedAt: number;
+}
+type McpRpcMethod = 'connect' | 'disconnect' | 'listTools' | 'callTool' | 'listSessions' | 'getSession' | 'finishAuth' | 'listPrompts' | 'getPrompt' | 'listResources' | 'readResource' | 'setToolPolicy' | 'getToolPolicy';
 interface McpRpcRequest {
     id: string;
     method: McpRpcMethod;
@@ -249,7 +256,17 @@ interface FinishAuthParams {
     state: string;
     code: string;
 }
-type McpRpcParams = ConnectParams | DisconnectParams | SessionParams | CallToolParams | GetPromptParams | ReadResourceParams | FinishAuthParams | undefined;
+interface SetToolPolicyParams {
+    sessionId: string;
+    toolPolicy: {
+        mode: ToolPolicyMode;
+        toolIds?: string[];
+    };
+}
+interface GetToolPolicyParams {
+    sessionId: string;
+}
+type McpRpcParams = ConnectParams | DisconnectParams | SessionParams | CallToolParams | GetPromptParams | ReadResourceParams | FinishAuthParams | SetToolPolicyParams | GetToolPolicyParams | undefined;
 interface SessionInfo {
     sessionId: string;
     serverId?: string;
@@ -263,6 +280,7 @@ interface SessionInfo {
      * `pending` means auth is in progress and should be resumed explicitly by user action.
      */
     status: SessionStatus;
+    toolPolicy?: ToolPolicy;
 }
 interface SessionListResult {
     sessions: SessionInfo[];
@@ -285,6 +303,22 @@ interface FinishAuthResult {
 interface ListToolsRpcResult {
     tools: Tool[];
 }
+interface SetToolPolicyResult {
+    success: boolean;
+    toolPolicy: ToolPolicy;
+    tools: Tool[];
+    toolCount: number;
+}
+type ToolAccessInfo = Tool & {
+    toolId: string;
+    allowed: boolean;
+};
+interface GetToolPolicyResult {
+    toolPolicy: ToolPolicy;
+    tools: ToolAccessInfo[];
+    toolCount: number;
+    allowedToolCount: number;
+}
 interface ListPromptsResult {
     prompts: Array<{
         name: string;
@@ -305,4 +339,4 @@ interface ListResourcesResult {
     }>;
 }
 
-export { type ToolClientProvider as A, type ToolInfo as B, type CallToolParams as C, type DisconnectParams as D, Emitter as E, type FinishAuthParams as F, type GetPromptParams as G, type TransportType as H, isCallToolSuccess as I, isConnectAuthRequired as J, isConnectError as K, type ListPromptsResult as L, type McpConnectionEvent as M, isConnectSuccess as N, isListToolsSuccess as O, type McpAppsUIEvent as P, type ReadResourceParams as R, type SessionInfo as S, type ToolClient as T, type CallToolRequest as a, type CallToolResponse as b, type ConnectAuthRequiredResponse as c, type ConnectErrorResponse as d, type ConnectParams as e, type ConnectRequest as f, type ConnectResponse as g, type ConnectResult as h, type ConnectSuccessResponse as i, type DisconnectResult as j, type Disposable as k, DisposableStore as l, type Event as m, type FinishAuthResult as n, type GetSessionResult as o, type ListResourcesResult as p, type ListToolsResponse as q, type ListToolsRpcResult as r, type McpConnectionState as s, type McpObservabilityEvent as t, type McpRpcMethod as u, type McpRpcParams as v, type McpRpcRequest as w, type McpRpcResponse as x, type SessionListResult as y, type SessionParams as z };
+export { type ToolClientProvider as A, type ToolInfo as B, type CallToolParams as C, type DisconnectParams as D, Emitter as E, type FinishAuthParams as F, type GetPromptParams as G, type TransportType as H, isCallToolSuccess as I, isConnectAuthRequired as J, isConnectError as K, type ListPromptsResult as L, type McpConnectionEvent as M, isConnectSuccess as N, isListToolsSuccess as O, type ToolPolicy as P, type SetToolPolicyResult as Q, type ReadResourceParams as R, type SessionInfo as S, type ToolClient as T, type GetToolPolicyResult as U, type McpAppsUIEvent as V, type CallToolRequest as a, type CallToolResponse as b, type ConnectAuthRequiredResponse as c, type ConnectErrorResponse as d, type ConnectParams as e, type ConnectRequest as f, type ConnectResponse as g, type ConnectResult as h, type ConnectSuccessResponse as i, type DisconnectResult as j, type Disposable as k, DisposableStore as l, type Event as m, type FinishAuthResult as n, type GetSessionResult as o, type ListResourcesResult as p, type ListToolsResponse as q, type ListToolsRpcResult as r, type McpConnectionState as s, type McpObservabilityEvent as t, type McpRpcMethod as u, type McpRpcParams as v, type McpRpcRequest as w, type McpRpcResponse as x, type SessionListResult as y, type SessionParams as z };

package/dist/{types-Bf-7GOLW.d.ts → types-DK_NGWd4.d.ts}

@@ -138,6 +138,7 @@ interface ToolClient {
     callTool(name: string, args: Record<string, unknown>): Promise<any>;
     getServerId?(): string | undefined;
     getServerName?(): string | undefined;
+    getServerUrl?(): string | undefined;
     getSessionId?(): string;
 }
 /**
@@ -203,7 +204,13 @@ type ToolInfo = {
 };
 type TransportType = 'sse' | 'streamable-http';
 type SessionStatus = 'pending' | 'active';
-type McpRpcMethod = 'connect' | 'disconnect' | 'listTools' | 'callTool' | 'listSessions' | 'getSession' | 'finishAuth' | 'listPrompts' | 'getPrompt' | 'listResources' | 'readResource';
+type ToolPolicyMode = 'all' | 'allowlist' | 'denylist';
+interface ToolPolicy {
+    mode: ToolPolicyMode;
+    toolIds: string[];
+    updatedAt: number;
+}
+type McpRpcMethod = 'connect' | 'disconnect' | 'listTools' | 'callTool' | 'listSessions' | 'getSession' | 'finishAuth' | 'listPrompts' | 'getPrompt' | 'listResources' | 'readResource' | 'setToolPolicy' | 'getToolPolicy';
 interface McpRpcRequest {
     id: string;
     method: McpRpcMethod;
@@ -249,7 +256,17 @@ interface FinishAuthParams {
     state: string;
     code: string;
 }
-type McpRpcParams = ConnectParams | DisconnectParams | SessionParams | CallToolParams | GetPromptParams | ReadResourceParams | FinishAuthParams | undefined;
+interface SetToolPolicyParams {
+    sessionId: string;
+    toolPolicy: {
+        mode: ToolPolicyMode;
+        toolIds?: string[];
+    };
+}
+interface GetToolPolicyParams {
+    sessionId: string;
+}
+type McpRpcParams = ConnectParams | DisconnectParams | SessionParams | CallToolParams | GetPromptParams | ReadResourceParams | FinishAuthParams | SetToolPolicyParams | GetToolPolicyParams | undefined;
 interface SessionInfo {
     sessionId: string;
     serverId?: string;
@@ -263,6 +280,7 @@ interface SessionInfo {
      * `pending` means auth is in progress and should be resumed explicitly by user action.
      */
     status: SessionStatus;
+    toolPolicy?: ToolPolicy;
 }
 interface SessionListResult {
     sessions: SessionInfo[];
@@ -285,6 +303,22 @@ interface FinishAuthResult {
 interface ListToolsRpcResult {
     tools: Tool[];
 }
+interface SetToolPolicyResult {
+    success: boolean;
+    toolPolicy: ToolPolicy;
+    tools: Tool[];
+    toolCount: number;
+}
+type ToolAccessInfo = Tool & {
+    toolId: string;
+    allowed: boolean;
+};
+interface GetToolPolicyResult {
+    toolPolicy: ToolPolicy;
+    tools: ToolAccessInfo[];
+    toolCount: number;
+    allowedToolCount: number;
+}
 interface ListPromptsResult {
     prompts: Array<{
         name: string;
@@ -305,4 +339,4 @@ interface ListResourcesResult {
     }>;
 }
 
-export { type ToolClientProvider as A, type ToolInfo as B, type CallToolParams as C, type DisconnectParams as D, Emitter as E, type FinishAuthParams as F, type GetPromptParams as G, type TransportType as H, isCallToolSuccess as I, isConnectAuthRequired as J, isConnectError as K, type ListPromptsResult as L, type McpConnectionEvent as M, isConnectSuccess as N, isListToolsSuccess as O, type McpAppsUIEvent as P, type ReadResourceParams as R, type SessionInfo as S, type ToolClient as T, type CallToolRequest as a, type CallToolResponse as b, type ConnectAuthRequiredResponse as c, type ConnectErrorResponse as d, type ConnectParams as e, type ConnectRequest as f, type ConnectResponse as g, type ConnectResult as h, type ConnectSuccessResponse as i, type DisconnectResult as j, type Disposable as k, DisposableStore as l, type Event as m, type FinishAuthResult as n, type GetSessionResult as o, type ListResourcesResult as p, type ListToolsResponse as q, type ListToolsRpcResult as r, type McpConnectionState as s, type McpObservabilityEvent as t, type McpRpcMethod as u, type McpRpcParams as v, type McpRpcRequest as w, type McpRpcResponse as x, type SessionListResult as y, type SessionParams as z };
+export { type ToolClientProvider as A, type ToolInfo as B, type CallToolParams as C, type DisconnectParams as D, Emitter as E, type FinishAuthParams as F, type GetPromptParams as G, type TransportType as H, isCallToolSuccess as I, isConnectAuthRequired as J, isConnectError as K, type ListPromptsResult as L, type McpConnectionEvent as M, isConnectSuccess as N, isListToolsSuccess as O, type ToolPolicy as P, type SetToolPolicyResult as Q, type ReadResourceParams as R, type SessionInfo as S, type ToolClient as T, type GetToolPolicyResult as U, type McpAppsUIEvent as V, type CallToolRequest as a, type CallToolResponse as b, type ConnectAuthRequiredResponse as c, type ConnectErrorResponse as d, type ConnectParams as e, type ConnectRequest as f, type ConnectResponse as g, type ConnectResult as h, type ConnectSuccessResponse as i, type DisconnectResult as j, type Disposable as k, DisposableStore as l, type Event as m, type FinishAuthResult as n, type GetSessionResult as o, type ListResourcesResult as p, type ListToolsResponse as q, type ListToolsRpcResult as r, type McpConnectionState as s, type McpObservabilityEvent as t, type McpRpcMethod as u, type McpRpcParams as v, type McpRpcRequest as w, type McpRpcResponse as x, type SessionListResult as y, type SessionParams as z };

package/migrations/neon/20260513010000_install_mcp_sessions.sql

@@ -17,6 +17,7 @@ CREATE TABLE IF NOT EXISTS public.mcp_sessions (
         CHECK (status IN ('pending', 'active')),
     headers JSONB,
     auth_url TEXT,
+    -- tool_policy JSONB -- optional, see docs/tool-policy
     CONSTRAINT mcp_sessions_user_session_unique
         UNIQUE (user_id, session_id)
 );

package/migrations/supabase/20260330195700_install_mcp_sessions.sql

@@ -15,6 +15,7 @@ CREATE TABLE IF NOT EXISTS public.mcp_sessions (
         CHECK (status IN ('pending', 'active')),
     headers JSONB,
     auth_url TEXT,
+    -- tool_policy JSONB -- optional, see docs/tool-policy
     CONSTRAINT mcp_sessions_user_session_unique
         UNIQUE (user_id, session_id)
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-ts/sdk",
-  "version": "2.4.4",
+  "version": "2.5.0",
   "publishConfig": {
     "access": "public"
   },

package/src/adapters/agui-adapter.ts

@@ -29,6 +29,7 @@
 import { MCPClient } from '../server/mcp/oauth-client.js';
 import { MultiSessionClient } from '../server/mcp/multi-session-client.js';
 import { ToolRouter } from '../shared/tool-router.js';
+import type { ToolClient } from '../shared/types.js';
 import { executeMetaTool, isMetaTool } from '../shared/meta-tools.js';
 
 /**
@@ -184,7 +185,7 @@ export class AguiAdapter {
         return typeof (this.client as any).getClients === 'function';
     }
 
-    private async transformTools(client: MCPClient): Promise<AguiTool[]> {
+    private async transformTools(client: ToolClient): Promise<AguiTool[]> {
         if (!client.isConnected()) return [];
 
         const result = await client.listTools();
@@ -214,7 +215,7 @@ export class AguiAdapter {
         });
     }
 
-    private async transformToolDefinitions(client: MCPClient): Promise<AguiToolDefinition[]> {
+    private async transformToolDefinitions(client: ToolClient): Promise<AguiToolDefinition[]> {
         if (!client.isConnected()) return [];
 
         const result = await client.listTools();
@@ -299,3 +300,6 @@ export class AguiAdapter {
         return `tool_${normalized}_${toolName}`;
     }
 }
+
+
+

package/src/adapters/ai-adapter.ts

@@ -3,6 +3,7 @@ import { MultiSessionClient } from '../server/mcp/multi-session-client';
 import type { JSONSchema7 } from 'json-schema';
 import type { ToolSet } from 'ai';
 import { ToolRouter } from '../shared/tool-router.js';
+import type { ToolClient } from '../shared/types.js';
 import { executeMetaTool, isMetaTool } from '../shared/meta-tools.js';
 
 export interface AIAdapterOptions {
@@ -54,7 +55,7 @@ export class AIAdapter {
         }
     }
 
-    private async transformTools(client: MCPClient): Promise<ToolSet> {
+    private async transformTools(client: ToolClient): Promise<ToolSet> {
         // Safe check for isConnected method (duck typing for bundler compatibility)
         const isConnected = typeof client.isConnected === 'function'
             ? client.isConnected()
@@ -217,3 +218,4 @@ export class AIAdapter {
         return new AIAdapter(client, options).getTools();
     }
 }
+

package/src/adapters/langchain-adapter.ts

@@ -3,6 +3,7 @@ import { MultiSessionClient } from '../server/mcp/multi-session-client';
 import type { DynamicStructuredTool, StructuredTool } from '@langchain/core/tools';
 import type { z } from 'zod';
 import { ToolRouter } from '../shared/tool-router.js';
+import type { ToolClient } from '../shared/types.js';
 import { executeMetaTool, isMetaTool } from '../shared/meta-tools.js';
 
 export interface LangChainAdapterOptions {
@@ -58,7 +59,7 @@ export class LangChainAdapter {
         }
     }
 
-    private async transformTools(client: MCPClient): Promise<StructuredTool[]> {
+    private async transformTools(client: ToolClient): Promise<StructuredTool[]> {
         if (!client.isConnected()) {
             return [];
         }
@@ -66,7 +67,7 @@ export class LangChainAdapter {
         await this.ensureDependencies();
 
         const result = await client.listTools();
-        const prefix = this.options.prefix ?? client.getServerId()?.replace(/-/g, '').substring(0, 8) ?? 'mcp';
+        const prefix = this.options.prefix ?? client.getServerId?.()?.replace(/-/g, '').substring(0, 8) ?? 'mcp';
 
         return result.tools.map((tool) => {
             // In a real implementation, you would use a library like 'json-schema-to-zod'
@@ -127,7 +128,7 @@ export class LangChainAdapter {
                 try {
                     return await this.transformTools(client);
                 } catch (error) {
-                    console.error(`[LangChainAdapter] Failed to fetch tools from ${client.getServerId()}:`, error);
+                    console.error(`[LangChainAdapter] Failed to fetch tools from ${client.getServerId?.() ?? "unknown"}:`, error);
                     return [];
                 }
             })
@@ -203,3 +204,4 @@ export class LangChainAdapter {
         return new LangChainAdapter(client, options).getTools();
     }
 }
+

package/src/adapters/mastra-adapter.ts

@@ -1,5 +1,6 @@
 import { MCPClient } from '../server/mcp/oauth-client';
 import { MultiSessionClient } from '../server/mcp/multi-session-client';
+import type { ToolClient } from '../shared/types.js';
 import type { z } from 'zod';
 
 export interface MastraAdapterOptions {
@@ -51,7 +52,7 @@ export class MastraAdapter {
 
 
 
-    private async transformTools(client: MCPClient): Promise<Record<string, MastraTool>> {
+    private async transformTools(client: ToolClient): Promise<Record<string, MastraTool>> {
         if (!client.isConnected()) {
             return {};
         }
@@ -59,7 +60,7 @@ export class MastraAdapter {
         await this.ensureZod();
 
         const result = await client.listTools();
-        const prefix = this.options.prefix ?? client.getServerId()?.replace(/-/g, '').substring(0, 8) ?? 'mcp';
+        const prefix = this.options.prefix ?? client.getServerId?.()?.replace(/-/g, '').substring(0, 8) ?? 'mcp';
         const tools: Record<string, MastraTool> = {};
 
         for (const tool of result.tools) {
@@ -113,7 +114,7 @@ export class MastraAdapter {
                 try {
                     return await this.transformTools(client);
                 } catch (error) {
-                    console.error(`[MastraAdapter] Failed to fetch tools from ${client.getServerId()}:`, error);
+                    console.error(`[MastraAdapter] Failed to fetch tools from ${client.getServerId?.() ?? "unknown"}:`, error);
                     return {};
                 }
             })
@@ -128,3 +129,4 @@ export class MastraAdapter {
         return new MastraAdapter(client, options).getTools();
     }
 }
+

package/src/client/core/sse-client.ts

@@ -25,6 +25,9 @@ import type {
   ListToolsRpcResult,
   ListPromptsResult,
   ListResourcesResult,
+  SetToolPolicyResult,
+  GetToolPolicyResult,
+  ToolPolicy,
 } from '../../shared/types.js';
 
 export interface SSEClientOptions {
@@ -99,6 +102,17 @@ export class SSEClient {
     return this.sendRequest<DisconnectResult>('disconnect', { sessionId });
   }
 
+  async setToolPolicy(
+    sessionId: string,
+    toolPolicy: Pick<ToolPolicy, 'mode'> & { toolIds?: string[] }
+  ): Promise<SetToolPolicyResult> {
+    return this.sendRequest<SetToolPolicyResult>('setToolPolicy', { sessionId, toolPolicy });
+  }
+
+  async getToolPolicy(sessionId: string): Promise<GetToolPolicyResult> {
+    return this.sendRequest<GetToolPolicyResult>('getToolPolicy', { sessionId });
+  }
+
   async listTools(sessionId: string): Promise<ListToolsRpcResult> {
     return this.sendRequest<ListToolsRpcResult>('listTools', { sessionId });
   }
@@ -367,3 +381,6 @@ export class SSEClient {
     }
   }
 }
+
+
+

package/src/client/react/use-mcp.ts

@@ -18,6 +18,9 @@ import type {
   ListPromptsResult,
   ListResourcesResult,
   SessionInfo,
+  ToolPolicy,
+  SetToolPolicyResult,
+  GetToolPolicyResult,
 } from '../../shared/types';
 
 export interface UseMcpOptions {
@@ -89,6 +92,7 @@ export interface McpConnection {
   error?: string;
   createdAt?: Date;
   updatedAt?: Date;
+  toolPolicy?: ToolPolicy;
 }
 
 export interface McpClient {
@@ -193,6 +197,19 @@ export interface McpClient {
    */
   listTools: (sessionId: string) => Promise<ListToolsRpcResult>;
 
+  /**
+   * Update per-session tool access policy
+   */
+  updateToolPolicy: (
+    sessionId: string,
+    toolPolicy: Pick<ToolPolicy, 'mode'> & { toolIds?: string[] }
+  ) => Promise<SetToolPolicyResult>;
+
+  /**
+   * Get all tools and effective policy state for access management
+   */
+  getToolAccess: (sessionId: string) => Promise<GetToolPolicyResult>;
+
   /**
    * List available prompts for a session
    */
@@ -428,6 +445,7 @@ export function useMcp(options: UseMcpOptions): McpClient {
             state: getInitialConnectionState(s.status),
             createdAt: new Date(s.createdAt),
             updatedAt: new Date(s.updatedAt ?? s.createdAt),
+            toolPolicy: s.toolPolicy,
             tools: [],
           }))
         );
@@ -607,6 +625,42 @@ export function useMcp(options: UseMcpOptions): McpClient {
     return await clientRef.current.listTools(sessionId);
   }, []);
 
+  /**
+   * Update tool access policy for a session
+   */
+  const updateToolPolicy = useCallback(async (
+    sessionId: string,
+    toolPolicy: Pick<ToolPolicy, 'mode'> & { toolIds?: string[] }
+  ): Promise<SetToolPolicyResult> => {
+    if (!clientRef.current) {
+      throw new Error('SSE client not initialized');
+    }
+
+    const result = await clientRef.current.setToolPolicy(sessionId, toolPolicy);
+    if (isMountedRef.current) {
+      setConnections((prev: McpConnection[]) => prev.map((connection) =>
+        connection.sessionId === sessionId
+          ? {
+              ...connection,
+              toolPolicy: result.toolPolicy,
+              tools: result.tools,
+              updatedAt: new Date(),
+            }
+          : connection
+      ));
+    }
+    return result;
+  }, []);
+  /**
+   * Get all tools with effective access state for a session
+   */
+  const getToolAccess = useCallback(async (sessionId: string): Promise<GetToolPolicyResult> => {
+    if (!clientRef.current) {
+      throw new Error('SSE client not initialized');
+    }
+
+    return await clientRef.current.getToolPolicy(sessionId);
+  }, []);
   /**
    * List prompts
    */
@@ -700,6 +754,8 @@ export function useMcp(options: UseMcpOptions): McpClient {
       resumeAuth,
       callTool,
       listTools,
+      updateToolPolicy,
+      getToolAccess,
       listPrompts,
       getPrompt,
       listResources,
@@ -724,6 +780,8 @@ export function useMcp(options: UseMcpOptions): McpClient {
       resumeAuth,
       callTool,
       listTools,
+      updateToolPolicy,
+      getToolAccess,
       listPrompts,
       getPrompt,
       listResources,
@@ -732,3 +790,8 @@ export function useMcp(options: UseMcpOptions): McpClient {
     ]
   );
 }
+
+
+
+
+