@payloadcms/plugin-mcp 4.0.0-internal.45cfa3d → 4.0.0-internal.4a6b4c3

package/src/mcp/builtin/globals/getGlobalSchemaTool.ts

@@ -1,12 +1,14 @@
+import { getAccessResults, getGlobalInputSchema, getGlobalSchemaInputSchema } from 'payload'
+import { getLLMInstructions } from 'payload/internal'
+
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
-import { getGlobalInputSchema } from '../../../utils/schemaConversion/getEntityInputSchema.js'
 
 export const getGlobalSchemaTool = defineGlobalTool({
   access: (args) => {
-    const permissions = args.permissions?.globals?.[args.globalSlug]
+    const permissions = args.permissions?.globals?.[args.slug]
 
-    return defaultAccess(args) && Boolean(permissions?.read || permissions?.update)
+    return defaultAccess(args) && Boolean(permissions?.update)
   },
   annotations: {
     destructiveHint: false,
@@ -15,27 +17,57 @@ export const getGlobalSchemaTool = defineGlobalTool({
     readOnlyHint: true,
     title: 'Get Global Schema',
   },
-  description: 'Get the input schema for updating a global.',
-}).handler(({ globalSlug, req }) => {
-  const inputSchema = getGlobalInputSchema({ globalSlug, req })
+  description: 'Get the input schema and LLM instructions before updating a global.',
+  input: getGlobalSchemaInputSchema,
+}).handler(async ({ slug, authorizedMCP, req }) => {
+  const permissions = authorizedMCP.overrideAccess
+    ? null
+    : (await getAccessResults({ req })).globals?.[slug]
+
+  if (!authorizedMCP.overrideAccess && !permissions?.update) {
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `Error: MCP access to "getGlobalSchema" is not enabled for global "${slug}"`,
+        },
+      ],
+      isError: true,
+    }
+  }
+
+  const inputSchema = getGlobalInputSchema({
+    globalSlug: slug,
+    req,
+    ...(permissions ? { permissions } : {}),
+  })
 
   if (!inputSchema) {
     return {
-      content: [{ type: 'text', text: `Error: Global "${globalSlug}" not found` }],
+      content: [{ type: 'text', text: `Error: Global "${slug}" not found` }],
       isError: true,
     }
   }
 
+  const instructions = await getLLMInstructions({
+    slug,
+    type: 'global',
+    overrideAccess: authorizedMCP.overrideAccess,
+    req,
+  })
+
   return {
     content: [
       {
         type: 'text',
-        text: `Schema for global "${globalSlug}":\n\`\`\`json\n${JSON.stringify(inputSchema)}\n\`\`\``,
+        text: `Schema for global "${slug}":\n\`\`\`json\n${JSON.stringify(inputSchema)}\n\`\`\``,
       },
+      ...(instructions ? [{ type: 'text' as const, text: instructions }] : []),
     ],
     structuredContent: {
-      globalSlug,
+      slug,
       schema: inputSchema,
+      ...(instructions ? { instructions } : {}),
     },
   }
 })

package/src/mcp/builtin/globals/restoreVersionTool.ts

@@ -1,17 +1,14 @@
-import type { PopulateType } from 'payload'
-
-import { z } from 'zod'
+import { restoreGlobalVersionInputSchema } from 'payload'
 
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 
-const DEFAULT_DESCRIPTION = 'Restore a global from a previous version in any version-enabled global.'
+const DEFAULT_DESCRIPTION =
+  'Restore a global from a previous version in any version-enabled global.'
 
 export const restoreGlobalVersionTool = defineGlobalTool({
-  access: (args) =>
-    defaultAccess(args) && Boolean(args.permissions?.globals?.[args.globalSlug]?.update),
+  access: (args) => defaultAccess(args) && Boolean(args.permissions?.globals?.[args.slug]?.update),
   annotations: {
     destructiveHint: true,
     idempotentHint: false,
@@ -20,53 +17,25 @@ export const restoreGlobalVersionTool = defineGlobalTool({
     title: 'Restore Global Version',
   },
   description: DEFAULT_DESCRIPTION,
-  input: z.object({
-    id: z.string().describe('The ID of the global version to restore'),
-    depth: z
-      .number()
-      .int()
-      .min(0)
-      .max(10)
-      .describe('How many levels deep to populate relationships in response')
-      .optional()
-      .default(0),
-    fallbackLocale: z
-      .string()
-      .describe('Optional: fallback locale code to use when requested locale is not available')
-      .optional(),
-    locale: z
-      .string()
-      .describe('Optional: locale code to restore in (e.g., "en", "es")')
-      .optional(),
-    populate: z
-      .record(z.string(), z.unknown())
-      .describe(
-        'Optional: control which fields to include from populated relationship or upload documents.',
-      )
-      .optional(),
-    showHiddenFields: z
-      .boolean()
-      .describe('Optional: include hidden fields in the restored global response')
-      .optional(),
-  }),
-}).handler(async ({ authorizedMCP, globalSlug, input, req }) => {
+  input: restoreGlobalVersionInputSchema,
+}).handler(async ({ slug, authorizedMCP, input, req }) => {
   const payload = req.payload
   const logger = getLogger({ payload })
-  const { id, depth, fallbackLocale, locale, populate, showHiddenFields } = input
+  const { id, depth, fallbackLocale, locale, populate, select } = input
 
-  logger.info(`Restoring version for global: ${globalSlug} with ID: ${id}`)
+  logger.info(`Restoring version for global: ${slug} with ID: ${id}`)
 
   try {
     const result = await payload.restoreGlobalVersion({
-      id,
-      slug: globalSlug,
+      id: String(id),
+      slug,
       depth,
+      overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...localAPIDefaults(authorizedMCP),
-      ...(fallbackLocale ? { fallbackLocale } : {}),
+      ...(fallbackLocale !== undefined ? { fallbackLocale } : {}),
       ...(locale ? { locale } : {}),
-      ...(populate ? { populate: populate as PopulateType } : {}),
-      ...(showHiddenFields !== undefined ? { showHiddenFields } : {}),
+      ...(populate ? { populate } : {}),
+      ...(select ? { select } : {}),
     })
     const resultObject = result as Record<string, unknown>
     const restoredGlobal =
@@ -78,19 +47,19 @@ export const restoreGlobalVersionTool = defineGlobalTool({
       content: [
         {
           type: 'text',
-          text: `Version "${id}" restored successfully for global "${globalSlug}"!\nRestored global:\n\`\`\`json\n${JSON.stringify(restoredGlobal)}\n\`\`\``,
+          text: `Version "${id}" restored successfully for global "${slug}"!\nRestored global:\n\`\`\`json\n${JSON.stringify(restoredGlobal)}\n\`\`\``,
         },
       ],
       doc: restoredGlobal,
     }
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : 'Unknown error'
-    logger.error(`Error restoring version ${id} for global ${globalSlug}: ${errorMessage}`)
+    logger.error(`Error restoring version ${id} for global ${slug}: ${errorMessage}`)
     return {
       content: [
         {
           type: 'text',
-          text: `❌ **Error restoring version "${id}" for global "${globalSlug}":** ${errorMessage}`,
+          text: `❌ **Error restoring version "${id}" for global "${slug}":** ${errorMessage}`,
         },
       ],
       isError: true,

package/src/mcp/builtin/globals/updateTool.ts

@@ -1,23 +1,20 @@
-import type { SelectType } from 'payload'
-
-import { z } from 'zod'
+import {
+  getGlobalVirtualFieldNames,
+  stripVirtualFields,
+  transformPointDataToPayload,
+  updateGlobalInputSchema,
+  validateGlobalData,
+} from 'payload'
 
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import {
-  getGlobalVirtualFieldNames,
-  stripVirtualFields,
-} from '../../../utils/getVirtualFieldNames.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
-import { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js'
-import { validateGlobalData } from '../validateEntityData.js'
+import { formatEntityError } from '../formatEntityError.js'
 
 const DEFAULT_DESCRIPTION = 'Update any Payload global by passing the global slug and data.'
 
 export const updateGlobalTool = defineGlobalTool({
-  access: (args) =>
-    defaultAccess(args) && Boolean(args.permissions?.globals?.[args.globalSlug]?.update),
+  access: (args) => defaultAccess(args) && Boolean(args.permissions?.globals?.[args.slug]?.update),
   annotations: {
     destructiveHint: true,
     idempotentHint: false,
@@ -26,72 +23,54 @@ export const updateGlobalTool = defineGlobalTool({
     title: 'Update Global',
   },
   description: DEFAULT_DESCRIPTION,
-  input: z.object({
-    data: z.record(z.string(), z.unknown()).describe('The global fields to update'),
-    depth: z
-      .number()
-      .describe('Optional: Depth of relationships to populate')
-      .optional()
-      .default(0),
-    draft: z
-      .boolean()
-      .describe('Optional: Whether to save as draft (default: false)')
-      .optional()
-      .default(false),
-    fallbackLocale: z
-      .string()
-      .describe('Optional: fallback locale code to use when requested locale is not available')
-      .optional(),
-    locale: z
-      .string()
-      .describe(
-        'Optional: locale code to update data in (e.g., "en", "es"). Use "all" to update all locales for localized fields',
-      )
-      .optional(),
-    select: z
-      .record(z.string(), z.unknown())
-      .describe(
-        'Optional: define exactly which fields you\'d like to return in the response, e.g., {"siteName": true}',
-      )
-      .optional(),
-  }),
-}).handler(async ({ authorizedMCP, globalSlug, input, req }) => {
+  input: updateGlobalInputSchema,
+}).handler(async ({ slug, authorizedMCP, input, req }) => {
   const payload = req.payload
   const logger = getLogger({ payload })
 
-  const { data, depth, draft, fallbackLocale, locale, select } = input
+  const {
+    data,
+    depth,
+    draft,
+    fallbackLocale,
+    locale,
+    overrideLock,
+    populate,
+    publishAllLocales,
+    select,
+    unpublishAllLocales,
+  } = input
 
-  logger.info(
-    `Updating global: ${globalSlug}, draft: ${draft}${locale ? `, locale: ${locale}` : ''}`,
-  )
+  logger.info(`Updating global: ${slug}, draft: ${draft}${locale ? `, locale: ${locale}` : ''}`)
 
   try {
-    const virtualFieldNames = getGlobalVirtualFieldNames(payload.config, globalSlug)
+    const virtualFieldNames = getGlobalVirtualFieldNames(payload.config, slug)
     const inputData = stripVirtualFields(data, virtualFieldNames)
-    const validationError = validateGlobalData({ data: inputData, globalSlug, req })
-
-    if (validationError) {
-      return validationError
-    }
+    validateGlobalData({ slug, data: inputData, req })
 
     const parsedData = transformPointDataToPayload(inputData)
 
     const updateOptions: Parameters<typeof payload.updateGlobal>[0] = {
-      slug: globalSlug,
+      slug,
       data: parsedData,
       depth,
       draft,
-      ...localAPIDefaults(authorizedMCP),
+      overrideAccess: authorizedMCP.overrideAccess,
+      overrideLock,
+      populate,
+      publishAllLocales,
+      req,
+      unpublishAllLocales,
     }
 
     if (locale) {
       updateOptions.locale = locale
     }
-    if (fallbackLocale) {
+    if (fallbackLocale !== undefined) {
       updateOptions.fallbackLocale = fallbackLocale
     }
     if (select) {
-      updateOptions.select = select as SelectType
+      updateOptions.select = select
     }
 
     const result = await payload.updateGlobal(updateOptions)
@@ -100,16 +79,14 @@ export const updateGlobalTool = defineGlobalTool({
       content: [
         {
           type: 'text',
-          text: `Global "${globalSlug}" updated successfully!\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
+          text: `Global "${slug}" updated successfully!\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
         },
       ],
       doc: result as Record<string, unknown>,
     }
   } catch (error) {
-    const errorMessage = error instanceof Error ? error.message : 'Unknown error'
-    logger.error(`Error updating global ${globalSlug}: ${errorMessage}`)
-    return {
-      content: [{ type: 'text', text: `Error updating global "${globalSlug}": ${errorMessage}` }],
-    }
+    const message = error instanceof Error ? error.message : 'Unknown error'
+    logger.error(`Error updating global ${slug}: ${message}`)
+    return formatEntityError({ slug, action: 'updating', entity: 'global', error, req })
   }
 })

package/src/mcp/builtinTools.ts

@@ -10,7 +10,7 @@ import {
 } from './builtin/collections/authTools.js'
 import { countDocumentsTool } from './builtin/collections/countTool.js'
 import { countVersionsTool } from './builtin/collections/countVersionsTool.js'
-import { createDocumentTool } from './builtin/collections/createTool.js'
+import { createDocumentsTool } from './builtin/collections/createTool.js'
 import { deleteDocumentsTool } from './builtin/collections/deleteTool.js'
 import { duplicateDocumentTool } from './builtin/collections/duplicateTool.js'
 import { findDistinctTool } from './builtin/collections/findDistinctTool.js'
@@ -20,6 +20,7 @@ import { findVersionsTool } from './builtin/collections/findVersionsTool.js'
 import { getCollectionSchemaTool } from './builtin/collections/getCollectionSchemaTool.js'
 import { restoreVersionTool } from './builtin/collections/restoreVersionTool.js'
 import { updateDocumentTool } from './builtin/collections/updateTool.js'
+import { getUploadInstructionsTool } from './builtin/collections/uploadInstructionsTool.js'
 import { getConfigInfoTool } from './builtin/getConfigInfoTool.js'
 import { countGlobalVersionsTool } from './builtin/globals/countVersionsTool.js'
 import { findGlobalTool } from './builtin/globals/findTool.js'
@@ -32,6 +33,7 @@ import { updateGlobalTool } from './builtin/globals/updateTool.js'
 type CollectionBuiltin = {
   mcpName: string
   requiresDuplicateEnabled?: boolean
+  requiresUpload?: boolean
   requiresVersions?: boolean
   tool: CollectionTool
 }
@@ -54,7 +56,7 @@ export const TOOL_BUILTINS = {
 export const COLLECTION_BUILTINS = {
   count: { mcpName: 'countDocuments', tool: countDocumentsTool },
   countVersions: { mcpName: 'countVersions', requiresVersions: true, tool: countVersionsTool },
-  create: { mcpName: 'createDocument', tool: createDocumentTool },
+  create: { mcpName: 'createDocuments', tool: createDocumentsTool },
   delete: { mcpName: 'deleteDocuments', tool: deleteDocumentsTool },
   duplicate: {
     mcpName: 'duplicateDocument',
@@ -70,6 +72,11 @@ export const COLLECTION_BUILTINS = {
   },
   findVersions: { mcpName: 'findVersions', requiresVersions: true, tool: findVersionsTool },
   getCollectionSchema: { mcpName: 'getCollectionSchema', tool: getCollectionSchemaTool },
+  getUploadInstructions: {
+    mcpName: 'getUploadInstructions',
+    requiresUpload: true,
+    tool: getUploadInstructionsTool,
+  },
   restoreVersion: { mcpName: 'restoreVersion', requiresVersions: true, tool: restoreVersionTool },
   update: { mcpName: 'updateDocument', tool: updateDocumentTool },
 } satisfies Record<string, CollectionBuiltin>

package/src/mcp/sanitizeMCPConfig.ts

@@ -103,6 +103,7 @@ export const sanitizeMCPConfig = ({
     hooks: pluginConfig.hooks,
     items,
     mcp: pluginConfig.mcp,
+    oauth: pluginConfig.oauth,
     overrideGetAuthorizedMCP: pluginConfig.overrideGetAuthorizedMCP,
   }
 }
@@ -127,7 +128,7 @@ const sanitizeCollectionConfig = ({
 
   for (const [
     toolKey,
-    { mcpName, requiresDuplicateEnabled, requiresVersions, tool },
+    { mcpName, requiresDuplicateEnabled, requiresUpload, requiresVersions, tool },
   ] of COLLECTION_BUILTIN_ENTRIES) {
     if (requiresVersions && !collection.versions) {
       continue
@@ -135,6 +136,9 @@ const sanitizeCollectionConfig = ({
     if (requiresDuplicateEnabled && isDuplicateDisabled) {
       continue
     }
+    if (requiresUpload && !collection.upload) {
+      continue
+    }
     const matchedConfigEntry = collectionPluginConfig?.tools?.[toolKey]
     if (matchedConfigEntry === false) {
       continue

package/src/stdio.ts

@@ -3,8 +3,8 @@ import type { Config, Plugin, SanitizedConfig } from 'payload'
 /* eslint-disable no-console */
 import { serveStdio } from '@modelcontextprotocol/server/stdio'
 import { fileURLToPath, pathToFileURL } from 'node:url'
-import { createLocalReq, getPayload } from 'payload'
-import { findConfig } from 'payload/node'
+import { createPayloadRequest, getPayload } from 'payload'
+import { findConfig, loadEnv } from 'payload/node'
 
 import type { SanitizedMCPPluginConfig } from './types.js'
 
@@ -28,6 +28,7 @@ export const runMcpStdio = async (): Promise<void> => {
     process.chdir(projectRoot)
   }
 
+  loadEnv()
   const configPath = findConfig()
   const configModule = await import(pathToFileURL(configPath).toString())
   const config = (await (configModule.default ?? configModule)) as SanitizedConfig
@@ -90,7 +91,7 @@ export const runMcpStdio = async (): Promise<void> => {
     headers.set('Authorization', process.env.PAYLOAD_MCP_AUTHORIZATION)
   }
 
-  const req = await createLocalReq({ req: { headers } }, payload)
+  const req = await createPayloadRequest({ payload, req: { headers } })
   req.payloadAPI = 'MCP' as const
   const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })
 

package/src/types.ts

@@ -1,8 +1,9 @@
 import type {
   CallToolResult,
   ContentBlock,
+  Implementation,
   JsonSchemaType,
-  McpServer,
+  McpServerOptions,
   ResourceTemplate,
   ServerContext,
   StandardSchemaWithJSON,
@@ -15,7 +16,6 @@ import type {
   MaybePromise,
   PayloadRequest,
   SanitizedPermissions,
-  User,
 } from 'payload'
 
 import type { GetAuthorizedMCPArgs } from './endpoint/access.js'
@@ -76,11 +76,11 @@ export type MCPAccessArgs = {
 }
 
 export type CollectionMCPAccessArgs = {
-  collectionSlug: CollectionSlug
+  slug: CollectionSlug
 } & MCPAccessArgs
 
 export type GlobalMCPAccessArgs = {
-  globalSlug: GlobalSlug
+  slug: GlobalSlug
 } & MCPAccessArgs
 
 export type ToolHandlerArgs<TSchema = undefined> = {
@@ -91,14 +91,19 @@ export type ToolHandlerArgs<TSchema = undefined> = {
 }
 
 export type CollectionToolHandlerArgs<TSchema = undefined> = {
-  collectionSlug: CollectionSlug
+  slug: CollectionSlug
 } & ToolHandlerArgs<TSchema>
 
 export type GlobalToolHandlerArgs<TSchema = undefined> = {
-  globalSlug: GlobalSlug
+  slug: GlobalSlug
 } & ToolHandlerArgs<TSchema>
 
 export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {
+  /**
+   * Runs while authorizing each MCP request, before the tool is advertised or called. Return
+   * `false` to make the tool unavailable for that request. This is skipped when `overrideAccess`
+   * is enabled.
+   */
   access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   annotations?: ToolAnnotations
   description: string
@@ -113,6 +118,12 @@ export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema |
 export type CollectionTool<
   TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined,
 > = {
+  /**
+   * Runs while authorizing each MCP request for this collection. Return `false` to reject calls
+   * to this tool for the collection. The shared tool is not advertised when no collections allow
+   * it, but can remain advertised when it is available for another collection. This is skipped
+   * when `overrideAccess` is enabled.
+   */
   access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>
   handler: (args: CollectionToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>
   input?: TSchema
@@ -120,6 +131,12 @@ export type CollectionTool<
 
 export type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> =
   {
+    /**
+     * Runs while authorizing each MCP request for this global. Return `false` to reject calls to
+     * this tool for the global. The shared tool is not advertised when no globals allow it, but
+     * can remain advertised when it is available for another global. This is skipped when
+     * `overrideAccess` is enabled.
+     */
     access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>
     handler: (args: GlobalToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>
     input?: TSchema
@@ -131,6 +148,10 @@ export type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSc
  * required handler) from being silently accepted at a built-in key slot.
  */
 export type MCPBuiltInCollectionToolOverride = {
+  /**
+   * Replaces the built-in tool's access check. Return `false` to make the tool unavailable for
+   * this collection. This is skipped when `overrideAccess` is enabled.
+   */
   access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>
   annotations?: ToolAnnotations
   description?: string
@@ -139,6 +160,10 @@ export type MCPBuiltInCollectionToolOverride = {
 }
 
 export type MCPBuiltInGlobalToolOverride = {
+  /**
+   * Replaces the built-in tool's access check. Return `false` to make the tool unavailable for
+   * this global. This is skipped when `overrideAccess` is enabled.
+   */
   access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>
   annotations?: ToolAnnotations
   description?: string
@@ -183,6 +208,11 @@ export type PromptHandlerArgs<TSchema = undefined> = {
 }
 
 export type Prompt<TSchema extends ToolInputSchema = ToolInputSchema> = {
+  /**
+   * Runs while authorizing each MCP request, before the prompt is advertised or used. Return
+   * `false` to make the prompt unavailable for that request. This is skipped when
+   * `overrideAccess` is enabled.
+   */
   access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   argsSchema: TSchema
   description: string
@@ -201,6 +231,11 @@ export type ResourceHandlerArgs = {
 }
 
 export type Resource = {
+  /**
+   * Runs while authorizing each MCP request, before the resource is advertised or read. Return
+   * `false` to make the resource unavailable for that request. This is skipped when
+   * `overrideAccess` is enabled.
+   */
   access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   description: string
   handler: (args: ResourceHandlerArgs) => MaybePromise<{
@@ -245,10 +280,56 @@ export type MCPPluginConfig = {
     afterToolCall?: MCPAfterToolCallHook[]
   }
   mcp?: {
+    /**
+     * Largest HTTP request body, in bytes, that the MCP endpoint accepts. Larger requests
+     * are answered with `413`. Base64 file uploads count toward this limit.
+     *
+     * @default 4194304 (4 MiB, the MCP SDK default)
+     */
+    maxRequestBodySize?: number
     serverOptions?: MCPServerOptions
     verboseLogs?: boolean
   }
-  /** Replace the default MCP authorization resolver. */
+  /**
+   * Lets MCP clients sign in through an OAuth authorization server. MCP requests without an
+   * authenticated user get a `401` that points to the protected resource metadata (RFC 9728),
+   * served by `oauthProtectedResourceHandler`. Payload's auth strategies must accept the
+   * issued access tokens.
+   */
+  oauth?: {
+    /**
+     * Called on MCP requests with a bearer token that Payload's auth strategies didn't accept.
+     *  Return the Payload user, including its `collection`, or `null` to answer with the OAuth challenge.
+     */
+    authenticate?: (args: {
+      req: PayloadRequest
+      token: string
+    }) => MaybePromise<PayloadRequest['user']>
+    /**
+     * The authorization servers that issue access tokens for MCP clients. Clients require each one
+     * to exactly match the `issuer` in that server's metadata, so pass a function when the exact
+     * value is only known at runtime, e.g. from the server's OpenID configuration or per host.
+     */
+    authorizationServers: ((args: { req: PayloadRequest }) => MaybePromise<string[]>) | string[]
+    /**
+     * The URL clients call to reach the MCP endpoint.
+     *
+     * @default the absolute URL of `/api/mcp`, based on `serverURL` or the request URL
+     */
+    resource?: string
+    /**
+     * Scopes MCP clients should request, e.g. `['openid', 'email', 'profile']`. Without them,
+     * clients request none, which some authorization servers reject or answer with a token that
+     * doesn't identify the user.
+     */
+    scopes?: string[]
+  }
+  /**
+   * Replace the default MCP authorization resolver.
+   *
+   * This hook replaces the default authentication flow. It must set `req.user` to the
+   * authenticated Payload user, or to `null` for an anonymous caller, before returning.
+   */
   overrideGetAuthorizedMCP?: (
     args: {
       pluginConfig: SanitizedMCPPluginConfig
@@ -262,11 +343,11 @@ export type MCPPluginConfig = {
 
 export type SanitizedMCPPluginConfig = {
   items: MCPItem[]
-} & Pick<MCPPluginConfig, 'disabled' | 'hooks' | 'mcp' | 'overrideGetAuthorizedMCP'>
+} & Pick<MCPPluginConfig, 'disabled' | 'hooks' | 'mcp' | 'oauth' | 'overrideGetAuthorizedMCP'>
 
 export type MCPServerOptions = {
-  options?: ConstructorParameters<typeof McpServer>[1]
-  serverInfo?: Partial<ConstructorParameters<typeof McpServer>[0]>
+  options?: McpServerOptions
+  serverInfo?: Partial<Implementation>
 }
 
 /**
@@ -312,13 +393,10 @@ export type MCPItem =
   | GlobalMCPItem
 
 /**
- * The caller's identity + the MCP items authorized for this request. Disabled
- * items and items blocked by access callbacks or Payload operation access are
- * absent from `items`. Tool handlers receive this via `args.authorizedMCP` so
- * they can spread `localAPIDefaults(authorizedMCP)` into every local API call.
+ * The MCP items and access mode authorized for this request. The authenticated user is available
+ * as `req.user`.
  */
 export type AuthorizedMCP = {
   items: MCPItem[]
   overrideAccess: boolean
-  user: null | User
 }

package/dist/mcp/builtin/collections/formatCollectionError.d.ts

@@ -1,9 +0,0 @@
-import type { CollectionSlug, PayloadRequest } from 'payload';
-import type { MCPToolResponse } from '../../../types.js';
-export declare const formatCollectionError: ({ action, collectionSlug, error, req, }: {
-    action: "creating" | "duplicating" | "updating";
-    collectionSlug: CollectionSlug;
-    error: unknown;
-    req: PayloadRequest;
-}) => MCPToolResponse;
-//# sourceMappingURL=formatCollectionError.d.ts.map

package/dist/mcp/builtin/collections/formatCollectionError.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"formatCollectionError.d.ts","sourceRoot":"","sources":["../../../../src/mcp/builtin/collections/formatCollectionError.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAgCxD,eAAO,MAAM,qBAAqB,GAAI,yCAKnC;IACD,MAAM,EAAE,UAAU,GAAG,aAAa,GAAG,UAAU,CAAA;IAC/C,cAAc,EAAE,cAAc,CAAA;IAC9B,KAAK,EAAE,OAAO,CAAA;IACd,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,eAuCH,CAAA"}