@payloadcms/plugin-mcp 4.0.0-canary.3 → 4.0.0-canary.5

package/src/stdio.ts

@@ -6,8 +6,9 @@ import { fileURLToPath, pathToFileURL } from 'node:url'
 import { createLocalReq, getPayload } from 'payload'
 import { findConfig } from 'payload/node'
 
-import type { AuthorizedMCP, SanitizedMCPPluginConfig } from './types.js'
+import type { SanitizedMCPPluginConfig } from './types.js'
 
+import { getAuthorizedMCP } from './endpoint/access.js'
 import { buildMcpServer } from './mcp/buildMcpServer.js'
 import { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'
 import { getPluginConfig } from './utils/getPluginConfig.js'
@@ -16,8 +17,9 @@ import { resolveProjectRoot } from './utils/resolveProjectRoot.js'
 /**
  * Stdio adapter for the Payload MCP server.
  *
- * Do not use in production. There's no auth; whoever can spawn the process gets
- * full access to your local data.
+ * Pass PAYLOAD_MCP_AUTHORIZATION when stdio should authenticate with the same
+ * Payload auth header as HTTP. In development, PAYLOAD_MCP_OVERRIDE_ACCESS=true
+ * skips access control for local setup.
  */
 export const runMcpStdio = async (): Promise<void> => {
   /**
@@ -62,14 +64,27 @@ export const runMcpStdio = async (): Promise<void> => {
     ;(payload.config.plugins ??= []).push(fakePluginFn)
   }
 
-  const authorizedMCP: AuthorizedMCP = {
-    items: pluginConfig.items,
-    overrideAccess: true,
-    user: null,
+  const overrideAccessEnv = process.env.PAYLOAD_MCP_OVERRIDE_ACCESS
+  let overrideAccess = false
+
+  if (overrideAccessEnv === 'true') {
+    overrideAccess = true
+  } else if (overrideAccessEnv && overrideAccessEnv !== 'false') {
+    throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS must be "true" or "false".')
+  }
+
+  if (overrideAccess && process.env.NODE_ENV !== 'development') {
+    throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS is only available in development.')
+  }
+
+  const headers = new Headers()
+  if (process.env.PAYLOAD_MCP_AUTHORIZATION) {
+    headers.set('Authorization', process.env.PAYLOAD_MCP_AUTHORIZATION)
   }
 
-  const req = await createLocalReq({}, payload)
+  const req = await createLocalReq({ req: { headers } }, payload)
   req.payloadAPI = 'MCP' as const
+  const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })
 
   const server = buildMcpServer({ authorizedMCP, pluginConfig, req })
 

package/src/types.ts

@@ -10,15 +10,15 @@ import type {
 } from '@modelcontextprotocol/server'
 import type {
   AuthCollectionSlug,
-  CollectionConfig,
   CollectionSlug,
-  DefaultDocumentIDType,
   GlobalSlug,
   MaybePromise,
   PayloadRequest,
+  SanitizedPermissions,
   TypedUser,
 } from 'payload'
 
+import type { GetAuthorizedMCPArgs } from './endpoint/access.js'
 import type {
   MCPCollectionAuthToolName,
   MCPCollectionBuiltinName,
@@ -36,27 +36,6 @@ export type { JsonSchemaType, StandardSchemaWithJSON, ToolAnnotations }
  */
 export type ToolInputSchema = JsonSchemaType | StandardSchemaWithJSON
 
-/**
- * Serializable mirror of `SanitizedMCPPluginConfig` for client components —
- * the full sanitized config carries functions (tool handlers, etc.) that can't
- * cross the server→client boundary. Built by `sanitizeClientPluginConfig` and
- * passed to the `AccessField` component via `clientProps`.
- *
- * @internal
- */
-export type ClientMCPPluginConfig = {
-  items: Array<{
-    collectionSlug?: string
-    configKey: string
-    description?: string
-    globalSlug?: string
-    /** Admin-UI bucket for collection/global tools: built-in CRUD, auth, or custom. */
-    group?: 'auth' | 'custom' | 'operations'
-    label: string
-    type: 'collectionTool' | 'globalTool' | 'prompt' | 'resource' | 'tool'
-  }>
-}
-
 export type MCPToolResponse = {
   content: ContentBlock[]
   /**
@@ -83,6 +62,19 @@ export type TypedInput<TSchema> = TSchema extends StandardSchemaWithJSON
     : StandardSchemaWithJSON.InferOutput<TSchema>
   : Record<string, unknown>
 
+export type MCPAccessArgs = {
+  permissions?: SanitizedPermissions
+  req: PayloadRequest
+}
+
+export type CollectionMCPAccessArgs = {
+  collectionSlug: CollectionSlug
+} & MCPAccessArgs
+
+export type GlobalMCPAccessArgs = {
+  globalSlug: GlobalSlug
+} & MCPAccessArgs
+
 export type ToolHandlerArgs<TSchema = undefined> = {
   authorizedMCP: AuthorizedMCP
   input: TypedInput<TSchema>
@@ -99,6 +91,7 @@ export type GlobalToolHandlerArgs<TSchema = undefined> = {
 } & ToolHandlerArgs<TSchema>
 
 export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {
+  access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   annotations?: ToolAnnotations
   description: string
   handler: (args: ToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>
@@ -112,12 +105,14 @@ export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema |
 export type CollectionTool<
   TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined,
 > = {
+  access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>
   handler: (args: CollectionToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>
   input?: TSchema
 } & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>
 
 export type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> =
   {
+    access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>
     handler: (args: GlobalToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>
     input?: TSchema
   } & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>
@@ -127,7 +122,16 @@ export type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSc
  * `handler?: never` prevents a full `CollectionTool`/`GlobalTool` (which has a
  * required handler) from being silently accepted at a built-in key slot.
  */
-export type MCPBuiltInToolOverride = {
+export type MCPBuiltInCollectionToolOverride = {
+  access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>
+  annotations?: ToolAnnotations
+  description?: string
+  handler?: never
+  overrideResponse?: MCPResponseOverride
+}
+
+export type MCPBuiltInGlobalToolOverride = {
+  access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>
   annotations?: ToolAnnotations
   description?: string
   handler?: never
@@ -142,13 +146,13 @@ export type MCPBuiltInToolOverride = {
 export type MCPTopLevelToolEntry = Tool
 
 export type MCPCollectionToolsMap = {
-  [customToolName: string]: boolean | CollectionTool | MCPBuiltInToolOverride | undefined
+  [customToolName: string]: boolean | CollectionTool | MCPBuiltInCollectionToolOverride | undefined
 } & {
-  [K in MCPCollectionBuiltinName]?: false | MCPBuiltInToolOverride
+  [K in MCPCollectionBuiltinName]?: false | MCPBuiltInCollectionToolOverride
 }
 
 export type MCPAuthCollectionToolsMap = {
-  [K in MCPCollectionAuthToolName]?: MCPBuiltInToolOverride | true
+  [K in MCPCollectionAuthToolName]?: MCPBuiltInCollectionToolOverride | true
 } & MCPCollectionToolsMap
 
 /** Auth-enabled collections get auth-tool name autocomplete; others get CRUD-only. */
@@ -157,9 +161,9 @@ export type MCPToolsMapForCollection<Slug extends CollectionSlug> = Slug extends
   : MCPCollectionToolsMap
 
 export type MCPGlobalToolsMap = {
-  [customToolName: string]: boolean | GlobalTool | MCPBuiltInToolOverride | undefined
+  [customToolName: string]: boolean | GlobalTool | MCPBuiltInGlobalToolOverride | undefined
 } & {
-  [K in MCPGlobalBuiltinName]?: false | MCPBuiltInToolOverride
+  [K in MCPGlobalBuiltinName]?: false | MCPBuiltInGlobalToolOverride
 }
 
 export type MCPTopLevelToolsMap = Record<string, Tool>
@@ -171,6 +175,7 @@ export type PromptHandlerArgs<TSchema = undefined> = {
 }
 
 export type Prompt<TSchema extends ToolInputSchema = ToolInputSchema> = {
+  access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   argsSchema: TSchema
   description: string
   handler: (args: PromptHandlerArgs<TSchema>) => MaybePromise<{
@@ -188,6 +193,7 @@ export type ResourceHandlerArgs = {
 }
 
 export type Resource = {
+  access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   description: string
   handler: (args: ResourceHandlerArgs) => MaybePromise<{
     contents: Array<{ text: string; uri: string }>
@@ -221,7 +227,7 @@ export type MCPPluginConfig = {
   collections?: {
     [Slug in CollectionSlug]?: MCPPluginCollectionConfig<Slug>
   }
-  /** Skip MCP registration. The API key collection is still added (so DB / types stay stable). */
+  /** Skip MCP endpoint registration. */
   disabled?: boolean
   globals?: {
     [Slug in GlobalSlug]?: MCPPluginGlobalConfig
@@ -230,25 +236,21 @@ export type MCPPluginConfig = {
     serverOptions?: MCPServerOptions
     verboseLogs?: boolean
   }
-  overrideApiKeyCollection?: (collection: CollectionConfig) => CollectionConfig
-  /** Replace the default API-key auth with a custom resolver. */
-  overrideAuth?: (args: {
-    getAPIKeyDoc: (overrideApiKey?: string) => Promise<MCPAPIKeysDoc>
-    getAuthorizedMCP: (args: { apiKeyDoc: MCPAPIKeysDoc }) => AuthorizedMCP
-    pluginConfig: SanitizedMCPPluginConfig
-    req: PayloadRequest
-  }) => MaybePromise<AuthorizedMCP>
+  /** Replace the default MCP authorization resolver. */
+  overrideGetAuthorizedMCP?: (
+    args: {
+      pluginConfig: SanitizedMCPPluginConfig
+    } & GetAuthorizedMCPArgs,
+  ) => MaybePromise<AuthorizedMCP>
   prompts?: Record<string, Prompt>
   resources?: Record<string, Resource>
   /** Cross-cutting tools (not scoped to any collection or global). */
   tools?: MCPTopLevelToolsMap
-  userCollection?: CollectionSlug
 }
 
 export type SanitizedMCPPluginConfig = {
   items: MCPItem[]
-  userCollection: CollectionSlug
-} & Pick<MCPPluginConfig, 'disabled' | 'mcp' | 'overrideApiKeyCollection' | 'overrideAuth'>
+} & Pick<MCPPluginConfig, 'disabled' | 'mcp' | 'overrideGetAuthorizedMCP'>
 
 export type MCPServerOptions = {
   options?: ConstructorParameters<typeof McpServer>[1]
@@ -256,52 +258,12 @@ export type MCPServerOptions = {
 }
 
 /**
- * Nested access tree as stored in the collection.
- * A `false` leaf disables that tool; missing keys defer to
- * defaults (built-in CRUD is on, opt-in tools are off).
- */
-export type MCPAPIKeysDocAccessTree = {
-  collections?: {
-    [CollectionSlug: CollectionSlug]: {
-      [ToolKey: string]: boolean
-    }
-  }
-  globals?: {
-    [GlobalSlug: GlobalSlug]: {
-      [ToolKey: string]: boolean
-    }
-  }
-  prompts?: {
-    [PromptKey: string]: boolean
-  }
-  resources?: {
-    [ResourceKey: string]: boolean
-  }
-  tools?: {
-    [ToolKey: string]: boolean
-  }
-}
-
-/**
- * Stored on `payload-mcp-api-keys` docs
- */
-export type MCPAPIKeysDoc = {
-  access: MCPAPIKeysDocAccessTree
-  apiKey?: string
-  apiKeyIndex?: string
-  id: DefaultDocumentIDType
-  lastUsed?: string
-  overrideAccess?: boolean
-  user: null | TypedUser
-}
-
-/**
- * One MCP primitive plus the metadata needed for access checks, admin UI, and
+ * One MCP primitive plus the metadata needed for config-driven filtering and
  * registration.
  *
- * - `configKey`: the config/API-key identifier, e.g. `find` or `echo`.
+ * - `configKey`: the config identifier, e.g. `find` or `echo`.
  * - `mcpName`: the MCP wire name, e.g. `findDocuments` or `echo`.
- * - `label`: human-readable admin checkbox text.
+ * - `label`: human-readable display text.
  */
 export type MCPItemBase = {
   configKey: string
@@ -338,10 +300,10 @@ export type MCPItem =
   | GlobalMCPItem
 
 /**
- * The caller's identity + the MCP items they can use for this request. Returned
- * by `getAuthorizedMCP`; denied items are simply absent from `items`. Handlers
- * receive this via `args.authorizedMCP` so they can spread
- * `localAPIDefaults(authorizedMCP)` into every local API call.
+ * The caller's identity + the MCP items authorized for this request. Disabled
+ * items and items blocked by access callbacks or Payload operation access are
+ * absent from `items`. Tool handlers receive this via `args.authorizedMCP` so
+ * they can spread `localAPIDefaults(authorizedMCP)` into every local API call.
  */
 export type AuthorizedMCP = {
   items: MCPItem[]

package/src/utils/getPluginConfig.ts

@@ -5,7 +5,7 @@ import type { SanitizedMCPPluginConfig } from '../types.js'
 /**
  * Returns the sanitized plugin config — the form produced by
  * `sanitizeMCPConfig` and stashed back on the plugin's `options` during init.
- * Callers downstream of plugin init can rely on `items`, `userCollection`, etc.
+ * Callers downstream of plugin init can rely on `items` and other defaults
  * being fully resolved.
  */
 export const getPluginConfig: (args: { config: SanitizedConfig }) => SanitizedMCPPluginConfig = ({

package/src/utils/schemaConversion/getEntityInputSchema.ts

@@ -9,11 +9,6 @@ import {
 
 import type { JsonSchemaType } from '../../types.js'
 
-import {
-  getCollectionVirtualFieldNames,
-  getGlobalVirtualFieldNames,
-} from '../getVirtualFieldNames.js'
-import { removeVirtualFieldsFromSchema } from './removeVirtualFieldsFromSchema.js'
 import { sanitizeEntitySchema } from './sanitizeEntitySchema.js'
 
 export const getCollectionInputSchema = ({
@@ -29,11 +24,7 @@ export const getCollectionInputSchema = ({
     return null
   }
 
-  return buildEntityInputSchema({
-    entity: collection,
-    req,
-    virtualFieldNames: getCollectionVirtualFieldNames(req.payload.config, collectionSlug),
-  })
+  return buildEntityInputSchema({ entity: collection, req })
 }
 
 export const getGlobalInputSchema = ({
@@ -49,30 +40,23 @@ export const getGlobalInputSchema = ({
     return null
   }
 
-  return buildEntityInputSchema({
-    entity: global,
-    req,
-    virtualFieldNames: getGlobalVirtualFieldNames(req.payload.config, globalSlug),
-  })
+  return buildEntityInputSchema({ entity: global, req })
 }
 
 const buildEntityInputSchema = ({
   entity,
   req,
-  virtualFieldNames,
 }: {
   entity: SanitizedCollectionConfig | SanitizedGlobalConfig
   req: PayloadRequest
-  virtualFieldNames: string[]
 }): JsonSchemaType =>
+  // The `input` variant is already the write shape; sanitizeEntitySchema only adds MCP-specific passes.
   sanitizeEntitySchema(
-    removeVirtualFieldsFromSchema(
-      entityToStandaloneJSONSchema({
-        config: req.payload.config,
-        defaultIDType: req.payload.db.defaultIDType,
-        entity,
-        i18n: req.i18n,
-      }) as unknown as JsonSchemaType,
-      virtualFieldNames,
-    ),
+    entityToStandaloneJSONSchema({
+      config: req.payload.config,
+      defaultIDType: req.payload.db.defaultIDType,
+      entity,
+      i18n: req.i18n,
+      variant: 'input',
+    }) as unknown as JsonSchemaType,
   )

package/src/utils/schemaConversion/sanitizeEntitySchema.spec.ts

@@ -5,10 +5,11 @@ import type { JsonSchemaType } from '../../types.js'
 import { sanitizeEntitySchema } from './sanitizeEntitySchema.js'
 
 describe('sanitizeEntitySchema', () => {
-  it('keeps a Lexical node union strict (oneOf) while simplifying relationship values to IDs', () => {
-    // Shaped like the schema the MCP server prepares for a collection with a Lexical richText field:
-    // a `$defs` node union (a `oneOf` of node shapes) where a relationship node's `value` is either
-    // an ID or a `$ref` to the populated related collection.
+  it('renames the Lexical node-union definition to a short name and keeps it a strict oneOf', () => {
+    // Shaped like the schema the MCP server prepares for a collection with a Lexical richText field
+    // (Payload's `input` variant): a `$defs` node union (a `oneOf` of node shapes). The input variant
+    // already types the relationship node's `value` as a bare ID - there is no populated-doc `$ref` to
+    // reduce here (the variant did that upstream), so sanitize leaves the value untouched.
     const standalone: JsonSchemaType = {
       type: 'object',
       $defs: {
@@ -25,17 +26,12 @@ describe('sanitizeEntitySchema', () => {
               additionalProperties: false,
               properties: {
                 type: { const: 'relationship' },
-                value: { oneOf: [{ type: 'string' }, { $ref: '#/$defs/posts' }] },
+                value: { type: 'string', description: 'The related document ID.' },
               },
               required: ['type'],
             },
           ],
         },
-        posts: {
-          type: 'object',
-          additionalProperties: false,
-          properties: { id: { type: 'string' }, title: { type: 'string' } },
-        },
       },
       properties: {
         id: { type: 'string' },
@@ -57,7 +53,7 @@ describe('sanitizeEntitySchema', () => {
       type: 'object',
       $defs: {
         // The node union is renamed to a short, readable `node`, and stays a strict discriminated
-        // `oneOf` - not loosened to `anyOf`...
+        // `oneOf` - not loosened to `anyOf`.
         node: {
           oneOf: [
             {
@@ -71,21 +67,18 @@ describe('sanitizeEntitySchema', () => {
               additionalProperties: false,
               properties: {
                 type: { const: 'relationship' },
-                // ...while the relationship `value` is simplified to a bare ID (the populated-doc `$ref` is dropped).
-                value: { type: 'string', description: 'The ID of the related "posts" document.' },
+                // The value is already ID-only from the input variant - left as-is.
+                value: { type: 'string', description: 'The related document ID.' },
               },
               required: ['type'],
             },
           ],
         },
-        posts: {
-          type: 'object',
-          additionalProperties: false,
-          properties: { id: { type: 'string' }, title: { type: 'string' } },
-        },
       },
       properties: {
-        // `id` is dropped - it's a Payload-managed field MCP clients never set.
+        // Managed fields (createdAt/updatedAt/_status) are excluded upstream by the `input` variant;
+        // `id` stays because it's a valid optional input (a client may supply a custom ID).
+        id: { type: 'string' },
         content: {
           type: 'object',
           properties: {

package/src/utils/schemaConversion/sanitizeEntitySchema.ts

@@ -1,30 +1,22 @@
 import type { JsonSchemaType } from '../../types.js'
 
 /**
- * Turns the JSON Schema that Payload generates for a collection or global into the input schema for
- * an MCP create/update tool. In short, it:
- *
- * - drops fields a client can't set (`id`, `createdAt`, the draft `_status`, …),
- * - rewrites Payload-specific field shapes (points, relationships) into plain JSON the model can fill,
- * - and shrinks the result so it's cheaper for the model to read,
- *
- * while keeping every node valid JSON Schema draft 2020-12. Each step below is tagged with why it runs -
- * **Correctness** (valid input the API accepts), **Size** (equivalence-preserving shrink), or **LLM
- * ergonomics** (easier for the model to read/fill) - and carries a before/after example on its definition.
+ * Refines Payload's `input`-variant JSON Schema into an MCP create/update tool's input schema. The
+ * variant already covers correctness (ID-only relationships, no managed/virtual/join fields); the
+ * passes here are MCP-specific - reshaping fields for the model and shrinking the result - and keep
+ * every node valid JSON Schema draft 2020-12. Each is tagged **Correctness**, **Size**, or **LLM
+ * ergonomics**, with a before/after example on its definition.
  */
 export const sanitizeEntitySchema = (schema: JsonSchemaType): JsonSchemaType => {
   // Work on a copy — the caller reuses the original schema elsewhere (e.g. when listing tools).
   let result = structuredClone(schema)
 
-  // Correctness — drop the fields a client can't set (id, createdAt, updatedAt, draft _status) + collapse nullable types.
-  result = removeManagedFields(result)
+  // LLM ergonomics — drop the redundant `'null'` from optional arrays/objects (`['array','null']` → `'array'`).
+  result = collapseOptionalContainerTypes(result)
 
   // LLM ergonomics — rewrite point fields from a `[number, number]` tuple into a `{ longitude, latitude }` object.
   result = pointFieldsToObjects(result)
 
-  // Correctness — a relationship value can be an ID or a populated doc; on input only the ID is valid, so keep that.
-  result = relationshipsToIds(result)
-
   // Size — strip inert type-gen leftovers that only bloat the schema (`tsType`, block-collision notes).
   result = removeTypeGenArtifacts(result)
 
@@ -58,26 +50,20 @@ const mapNodes = (node: unknown, visit: (node: JsonSchemaType) => JsonSchemaType
   for (const [key, value] of Object.entries(node)) {
     out[key] = mapNodes(value, visit)
   }
-  return visit(out as JsonSchemaType)
+  return visit(out)
 }
 
-// Payload sets these on every document, so an MCP client never provides them when creating/updating.
-const PAYLOAD_MANAGED_FIELDS = new Set(['_status', 'createdAt', 'id', 'updatedAt'])
-
 /**
- * **Correctness.** Removes the fields a client can't set on create/update - `id`, `createdAt`, `updatedAt`, and the draft
- * `_status` - from every field object's `properties` and `required` (recursing into nested objects and
- * array items). Along the way it also collapses optional array/object types via {@link collapseNullableType}.
+ * **LLM ergonomics.** Collapses optional array/object types (`['array', 'null']` → `'array'`) via
+ * {@link collapseNullableType}, recursing through `properties` and array items. The `required` list
+ * already conveys optionality, so the `'null'` is redundant noise for the model.
  *
  * @example
- * { properties: { id: { type: 'string' }, tags: { type: ['array', 'null'], items: {} } }, required: ['id', 'tags'] }
- * → { properties: { tags: { type: 'array', items: {} } }, required: ['tags'] }
+ * { properties: { tags: { type: ['array', 'null'], items: {} } }, required: [] }
+ * → { properties: { tags: { type: 'array', items: {} } }, required: [] }
  */
-const removeManagedFields = (schema: JsonSchemaType): JsonSchemaType => {
+const collapseOptionalContainerTypes = (schema: JsonSchemaType): JsonSchemaType => {
   if (schema.properties && typeof schema.properties === 'object') {
-    for (const field of PAYLOAD_MANAGED_FIELDS) {
-      delete schema.properties[field]
-    }
     for (const key of Object.keys(schema.properties)) {
       const prop = schema.properties[key] as JsonSchemaType
       if (!prop || typeof prop !== 'object') {
@@ -86,21 +72,14 @@ const removeManagedFields = (schema: JsonSchemaType): JsonSchemaType => {
       const isRequired = Array.isArray(schema.required) && schema.required.includes(key)
       collapseNullableType(prop, isRequired)
       if (prop.properties) {
-        removeManagedFields(prop)
+        collapseOptionalContainerTypes(prop)
       }
       if (prop.items && typeof prop.items === 'object' && !Array.isArray(prop.items)) {
-        removeManagedFields(prop.items)
+        collapseOptionalContainerTypes(prop.items)
       }
     }
   }
 
-  if (Array.isArray(schema.required)) {
-    schema.required = schema.required.filter((name) => !PAYLOAD_MANAGED_FIELDS.has(name))
-    if (schema.required.length === 0) {
-      delete schema.required
-    }
-  }
-
   return schema
 }
 
@@ -193,82 +172,6 @@ const pointFieldsToObjects = (schema: JsonSchemaType): JsonSchemaType => {
   return transformed
 }
 
-/**
- * **Correctness.** Reduces relationship/upload fields to the IDs a client actually sends. Payload types the value as
- * "an ID or the full related document" - but the populated-document form only appears in read responses;
- * on create/update you always reference a relationship by its ID. So we drop that `$ref` option, leaving
- * the bare ID. A single remaining target collapses inline (with a description naming the target
- * collection); several targets become an `anyOf` of IDs.
- *
- * @example
- * { oneOf: [{ type: 'string' }, { $ref: '#/$defs/posts' }] }
- * → { type: 'string', description: 'The ID of the related "posts" document.' }
- */
-const relationshipsToIds = (schema: JsonSchemaType): JsonSchemaType => {
-  if (!schema || typeof schema !== 'object') {
-    return schema
-  }
-
-  const processed = { ...schema }
-
-  if (Array.isArray(processed.oneOf)) {
-    const isRelatedDocRef = (option: unknown): option is { $ref: string } =>
-      !!option && typeof option === 'object' && '$ref' in option
-
-    if (processed.oneOf.some(isRelatedDocRef)) {
-      // A relationship value is "an ID, or the populated related document". Keep the ID option(s) and
-      // drop the `$ref`s to the related collections, since a client only ever sends the ID.
-      const idOptions = processed.oneOf
-        .filter((option) => !isRelatedDocRef(option))
-        .map((option) => (typeof option === 'object' ? relationshipsToIds(option) : option))
-      const targetCollections = processed.oneOf
-        .filter(isRelatedDocRef)
-        .map((option) => option.$ref.replace('#/$defs/', ''))
-
-      if (idOptions.length === 1) {
-        delete processed.oneOf
-        Object.assign(processed, idOptions[0])
-        if (targetCollections.length > 0 && !processed.description) {
-          processed.description = `The ID of the related "${targetCollections.join('" or "')}" document.`
-        }
-      } else if (idOptions.length > 1) {
-        delete processed.oneOf
-        processed.anyOf = idOptions
-      }
-    } else {
-      processed.oneOf = processed.oneOf.map((option) =>
-        typeof option === 'object' ? relationshipsToIds(option) : option,
-      )
-    }
-  }
-
-  if (processed.properties && typeof processed.properties === 'object') {
-    processed.properties = Object.fromEntries(
-      Object.entries(processed.properties).map(([key, value]) => [
-        key,
-        typeof value === 'object' ? relationshipsToIds(value) : value,
-      ]),
-    )
-  }
-
-  if (processed.items && typeof processed.items === 'object' && !Array.isArray(processed.items)) {
-    processed.items = relationshipsToIds(processed.items)
-  }
-
-  // Lexical node unions and blocks live under `$defs` and have their own relationship fields, so walk
-  // those too — otherwise their `$ref`s would dangle once we don't bundle the related collections.
-  if (processed.$defs && typeof processed.$defs === 'object') {
-    processed.$defs = Object.fromEntries(
-      Object.entries(processed.$defs).map(([key, value]) => [
-        key,
-        typeof value === 'object' ? relationshipsToIds(value) : value,
-      ]),
-    )
-  }
-
-  return processed
-}
-
 /**
  * **Size.** Strips type-generation leftovers that bloat the schema without helping the model: the `tsType`
  * hint (a `json-schema-to-typescript` extension; JSON Schema validators just ignore it, they don't reject it)
@@ -448,7 +351,7 @@ const deduplicateIntoDefinitions = (schema: JsonSchemaType): JsonSchemaType => {
         if (!name) {
           name = `shared_${nameByKey.size}`
           nameByKey.set(key, name)
-          sharedEntries[name] = node as JsonSchemaType
+          sharedEntries[name] = node
         }
         return { $ref: `#/$defs/${name}` }
       }

package/dist/collection/getAccessField.d.ts

@@ -1,12 +0,0 @@
-import type { JSONField } from 'payload';
-import type { SanitizedMCPPluginConfig } from '../types.js';
-/**
- * Returns the API key collection's `access` field — a JSON field whose value
- * is the `MCPAPIKeysDocAccessTree` the endpoint consults. The actual UI is
- * a custom client component (`AccessField`) which renders a permissions
- * matrix; the field's stored shape is just the runtime access tree.
- */
-export declare const getAccessField: ({ pluginConfig, }: {
-    pluginConfig: SanitizedMCPPluginConfig;
-}) => JSONField;
-//# sourceMappingURL=getAccessField.d.ts.map

package/dist/collection/getAccessField.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getAccessField.d.ts","sourceRoot":"","sources":["../../src/collection/getAccessField.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAExC,OAAO,KAAK,EAAkC,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAQ3F;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,mBAE5B;IACD,YAAY,EAAE,wBAAwB,CAAA;CACvC,KAAG,SAiBH,CAAA"}