@payloadcms/plugin-mcp 4.0.0-internal.5a4aa81 → 4.0.0-internal.5e065b3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (50) hide show
  1. package/bin.js +0 -7
  2. package/dist/endpoint/index.d.ts.map +1 -1
  3. package/dist/endpoint/index.js +33 -4
  4. package/dist/endpoint/index.js.map +1 -1
  5. package/dist/mcp/buildMcpServer.d.ts +1 -1
  6. package/dist/mcp/buildMcpServer.d.ts.map +1 -1
  7. package/dist/mcp/buildMcpServer.js +2 -2
  8. package/dist/mcp/buildMcpServer.js.map +1 -1
  9. package/dist/mcp/builtin/collections/authTools.d.ts.map +1 -1
  10. package/dist/mcp/builtin/collections/authTools.js +4 -3
  11. package/dist/mcp/builtin/collections/authTools.js.map +1 -1
  12. package/dist/mcp/builtin/collections/deleteTool.js +6 -2
  13. package/dist/mcp/builtin/collections/deleteTool.js.map +1 -1
  14. package/dist/mcp/builtin/collections/duplicateTool.d.ts.map +1 -1
  15. package/dist/mcp/builtin/collections/duplicateTool.js +6 -2
  16. package/dist/mcp/builtin/collections/duplicateTool.js.map +1 -1
  17. package/dist/mcp/builtin/collections/fileInput.d.ts.map +1 -1
  18. package/dist/mcp/builtin/collections/fileInput.js +19 -54
  19. package/dist/mcp/builtin/collections/fileInput.js.map +1 -1
  20. package/dist/mcp/builtin/collections/findTool.js +7 -3
  21. package/dist/mcp/builtin/collections/findTool.js.map +1 -1
  22. package/dist/mcp/builtin/collections/getCollectionSchemaTool.d.ts.map +1 -1
  23. package/dist/mcp/builtin/collections/getCollectionSchemaTool.js +19 -3
  24. package/dist/mcp/builtin/collections/getCollectionSchemaTool.js.map +1 -1
  25. package/dist/mcp/builtin/collections/updateTool.d.ts.map +1 -1
  26. package/dist/mcp/builtin/collections/updateTool.js +6 -2
  27. package/dist/mcp/builtin/collections/updateTool.js.map +1 -1
  28. package/dist/mcp/builtin/globals/getGlobalSchemaTool.d.ts.map +1 -1
  29. package/dist/mcp/builtin/globals/getGlobalSchemaTool.js +19 -3
  30. package/dist/mcp/builtin/globals/getGlobalSchemaTool.js.map +1 -1
  31. package/dist/stdio.js +4 -3
  32. package/dist/stdio.js.map +1 -1
  33. package/dist/types.d.ts +10 -3
  34. package/dist/types.d.ts.map +1 -1
  35. package/dist/types.js.map +1 -1
  36. package/package.json +6 -6
  37. package/src/endpoint/index.ts +33 -3
  38. package/src/mcp/buildMcpServer.ts +3 -3
  39. package/src/mcp/builtin/collections/authTools.ts +5 -2
  40. package/src/mcp/builtin/collections/deleteTool.ts +2 -2
  41. package/src/mcp/builtin/collections/duplicateTool.ts +2 -1
  42. package/src/mcp/builtin/collections/fileInput.ts +17 -59
  43. package/src/mcp/builtin/collections/findTool.ts +3 -3
  44. package/src/mcp/builtin/collections/getCollectionSchemaTool.ts +12 -1
  45. package/src/mcp/builtin/collections/updateTool.ts +2 -1
  46. package/src/mcp/builtin/globals/getGlobalSchemaTool.ts +11 -1
  47. package/src/stdio.ts +2 -2
  48. package/src/types.ts +11 -3
  49. package/dist/mcp/builtin/collections/fileInput.spec.js +0 -86
  50. package/dist/mcp/builtin/collections/fileInput.spec.js.map +0 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@payloadcms/plugin-mcp",
3
- "version": "4.0.0-internal.5a4aa81",
3
+ "version": "4.0.0-internal.5e065b3",
4
4
  "description": "MCP (Model Context Protocol) capabilities with Payload",
5
5
  "keywords": [
6
6
  "plugin",
@@ -55,15 +55,15 @@
55
55
  "bin.js"
56
56
  ],
57
57
  "dependencies": {
58
- "@modelcontextprotocol/server": "2.0.0",
59
- "tsx": "4.22.4"
58
+ "@modelcontextprotocol/server": "2.3.1",
59
+ "tsx": "4.23.15"
60
60
  },
61
61
  "devDependencies": {
62
62
  "@payloadcms/eslint-config": "3.28.0",
63
- "payload": "4.0.0-internal.5a4aa81"
63
+ "payload": "4.0.0-internal.5e065b3"
64
64
  },
65
65
  "peerDependencies": {
66
- "payload": "4.0.0-internal.5a4aa81"
66
+ "payload": "4.0.0-internal.5e065b3"
67
67
  },
68
68
  "//deps_notes": {
69
69
  "tsx": "Required by the `bin.js` stdio mcp. Keep the version pinned to whatever `payload` ships to avoid duplicate installs."
@@ -75,7 +75,7 @@
75
75
  "build:swc": "swc ./src -d ./dist --config-file .swcrc --strip-leading-paths",
76
76
  "build:types": "tsc --emitDeclarationOnly --outDir dist",
77
77
  "clean": "rimraf {dist,*.tsbuildinfo}",
78
- "copyfiles": "copyfiles -u 1 \"src/**/*.{html,css,scss,ttf,woff,woff2,eot,svg,jpg,png,json}\" dist/",
78
+ "copyfiles": "copyfiles -u 1 -e \"**/*.spec.*\" \"src/**/*.{html,css,scss,ttf,woff,woff2,eot,svg,jpg,png,json}\" dist/",
79
79
  "lint": "eslint .",
80
80
  "lint:fix": "eslint . --fix",
81
81
  "pack:plugin": "pnpm build && pnpm pack"
@@ -3,6 +3,7 @@ import type { PayloadHandler, PayloadRequest } from 'payload'
3
3
  import {
4
4
  createMcpHandler,
5
5
  isLegacyRequest,
6
+ readRequestBody,
6
7
  WebStandardStreamableHTTPServerTransport,
7
8
  } from '@modelcontextprotocol/server'
8
9
  import { APIError } from 'payload'
@@ -33,14 +34,17 @@ export const mcpEndpoint: PayloadHandler = async (req) => {
33
34
  }
34
35
 
35
36
  const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })
37
+ const maxRequestBodySize = pluginConfig.mcp?.maxRequestBodySize
36
38
  // Payload augments the original web-standard Request in place.
37
39
  const mcpRequest = req as PayloadRequest & Request
40
+ const parsedBody = await parseRequestBody({ maxRequestBodySize, request: mcpRequest })
38
41
 
39
42
  // Keep the old JSON-only, stateless behavior because the SDK's 2025 fallback uses SSE.
40
- if (await isLegacyRequest(mcpRequest)) {
43
+ if (await isLegacyRequest(mcpRequest, parsedBody, { maxRequestBodySize })) {
41
44
  const server = buildMcpServer({ authorizedMCP, pluginConfig, req })
42
45
  const transport = new WebStandardStreamableHTTPServerTransport({
43
46
  enableJsonResponse: true,
47
+ maxRequestBodySize,
44
48
  sessionIdGenerator: undefined, // stateless mode
45
49
  })
46
50
  transport.onerror = (err) => {
@@ -49,7 +53,7 @@ export const mcpEndpoint: PayloadHandler = async (req) => {
49
53
 
50
54
  try {
51
55
  await server.connect(transport)
52
- return await transport.handleRequest(mcpRequest)
56
+ return await transport.handleRequest(mcpRequest, { parsedBody })
53
57
  } finally {
54
58
  await server.close().catch((err) => {
55
59
  req.payload.logger.error({ err, msg: 'Error closing MCP server' })
@@ -59,6 +63,7 @@ export const mcpEndpoint: PayloadHandler = async (req) => {
59
63
 
60
64
  const handler = createMcpHandler(() => buildMcpServer({ authorizedMCP, pluginConfig, req }), {
61
65
  legacy: 'reject',
66
+ maxRequestBodySize,
62
67
  // SDK subscriptions always use SSE, so disable them to keep every response JSON-only.
63
68
  maxSubscriptions: 0,
64
69
  onerror: (err) => {
@@ -68,10 +73,35 @@ export const mcpEndpoint: PayloadHandler = async (req) => {
68
73
  })
69
74
 
70
75
  try {
71
- return await handler.fetch(mcpRequest)
76
+ return await handler.fetch(mcpRequest, { parsedBody })
72
77
  } finally {
73
78
  await handler.close().catch((err) => {
74
79
  req.payload.logger.error({ err, msg: 'Error closing modern MCP handler' })
75
80
  })
76
81
  }
77
82
  }
83
+
84
+ /**
85
+ * Parses a POST body once so the era check and the SDK handler can share it. The SDK
86
+ * skips its size limit for a pre-parsed body, so this reads with the same limit. It reads
87
+ * a clone and returns `undefined` for any body the SDK should reject (too large, unreadable,
88
+ * or not JSON), leaving the original request for the SDK to read and answer.
89
+ */
90
+ const parseRequestBody = async ({
91
+ maxRequestBodySize,
92
+ request,
93
+ }: {
94
+ maxRequestBodySize?: number
95
+ request: Request
96
+ }): Promise<unknown> => {
97
+ if (request.method.toUpperCase() !== 'POST') {
98
+ return undefined
99
+ }
100
+
101
+ try {
102
+ const body = await readRequestBody(request.clone(), maxRequestBodySize)
103
+ return body.tooLarge ? undefined : JSON.parse(body.text)
104
+ } catch {
105
+ return undefined
106
+ }
107
+ }
@@ -17,8 +17,6 @@ import type {
17
17
  import { getLogger } from '../utils/getLogger.js'
18
18
  import { toStandardSchema } from '../utils/toStandardSchema.js'
19
19
 
20
- z.config(z.locales.en())
21
-
22
20
  /**
23
21
  * Serving-entry-agnostic core: registers every authorized MCP item onto a fresh
24
22
  * `McpServer` and returns it. The HTTP and stdio entry point callers provide fresh
@@ -27,7 +25,7 @@ z.config(z.locales.en())
27
25
  *
28
26
  * `req` is the request context handlers see. For HTTP it's the live
29
27
  * `PayloadRequest` derived from the incoming HTTP request; for stdio it's a
30
- * synthesized one built via `createLocalReq`.
28
+ * synthesized one built via `createPayloadRequest`.
31
29
  */
32
30
  export const buildMcpServer = ({
33
31
  authorizedMCP,
@@ -38,6 +36,8 @@ export const buildMcpServer = ({
38
36
  pluginConfig: SanitizedMCPPluginConfig
39
37
  req: PayloadRequest
40
38
  }): McpServer => {
39
+ z.config(z.locales.en())
40
+
41
41
  const serverOptions = pluginConfig.mcp?.serverOptions || {}
42
42
  const server = new McpServer(
43
43
  { name: 'Payload MCP Server', version: '1.0.0', ...serverOptions.serverInfo },
@@ -1,4 +1,4 @@
1
- import { createLocalReq, strictObject, z } from 'payload'
1
+ import { createPayloadRequest, strictObject, z } from 'payload'
2
2
 
3
3
  import type { MCPToolResponse } from '../../../types.js'
4
4
 
@@ -53,7 +53,10 @@ export const authCollectionTool = defineCollectionTool({
53
53
  if (input.headers) {
54
54
  authHeaders = new Headers(input.headers)
55
55
  }
56
- const authReq = await createLocalReq({ req: { headers: authHeaders } }, req.payload)
56
+ const authReq = await createPayloadRequest({
57
+ payload: req.payload,
58
+ req: { headers: authHeaders },
59
+ })
57
60
  const result = await req.payload.auth({ headers: authHeaders, req: authReq })
58
61
 
59
62
  if (result.user) {
@@ -1,4 +1,4 @@
1
- import { deleteDocumentsInputSchema } from 'payload'
1
+ import { deleteDocumentsInputSchema, parseDocumentID } from 'payload'
2
2
 
3
3
  import { defaultAccess } from '../../../defaultAccess.js'
4
4
  import { defineCollectionTool } from '../../../defineTool.js'
@@ -32,7 +32,7 @@ export const deleteDocumentsTool = defineCollectionTool({
32
32
  try {
33
33
  if (id !== undefined) {
34
34
  const result = await payload.delete({
35
- id,
35
+ id: parseDocumentID({ id, collectionSlug: slug, payload }),
36
36
  collection: slug,
37
37
  depth,
38
38
  overrideAccess: authorizedMCP.overrideAccess,
@@ -1,6 +1,7 @@
1
1
  import {
2
2
  duplicateDocumentInputSchema,
3
3
  getCollectionVirtualFieldNames,
4
+ parseDocumentID,
4
5
  stripVirtualFields,
5
6
  transformPointDataToPayload,
6
7
  validateCollectionData,
@@ -50,7 +51,7 @@ export const duplicateDocumentTool = defineCollectionTool({
50
51
  const parsedData = inputData ? transformPointDataToPayload(inputData) : undefined
51
52
 
52
53
  const result = await payload.duplicate({
53
- id,
54
+ id: parseDocumentID({ id, collectionSlug: slug, payload }),
54
55
  collection: slug,
55
56
  depth,
56
57
  draft,
@@ -1,7 +1,11 @@
1
- import type { CollectionSlug, File, FileData, PayloadRequest } from 'payload'
1
+ import type { CollectionSlug, File, PayloadRequest } from 'payload'
2
2
 
3
3
  import { APIError, z } from 'payload'
4
- import { getExternalFile, getFileFromUploadInstructions, isURLAllowed } from 'payload/internal'
4
+ import {
5
+ externalURLInputSchema,
6
+ getFileFromUploadInstructions,
7
+ resolveURLUploadInput,
8
+ } from 'payload/internal'
5
9
  import { sanitizeFilename } from 'payload/shared'
6
10
 
7
11
  const mimeTypeSchema = z
@@ -30,11 +34,7 @@ export const fileInputSchema = z
30
34
  mimeType: mimeTypeSchema.check(z.describe('The file MIME type, for example image/png.')),
31
35
  source: z.literal('base64'),
32
36
  }),
33
- z.strictObject({
34
- name: z.optional(z.string().check(z.minLength(1))).check(z.describe('File name override.')),
35
- source: z.literal('externalURL'),
36
- url: z.url().check(z.describe('The http or https URL to download.')),
37
- }),
37
+ externalURLInputSchema,
38
38
  z.strictObject({
39
39
  file: uploadFileSchema.check(z.describe('getUploadInstructions file field post-upload.')),
40
40
  source: z.literal('uploadReference'),
@@ -75,6 +75,10 @@ export async function resolveFile({
75
75
  }
76
76
  }
77
77
 
78
+ if (input.source === 'externalURL') {
79
+ return resolveURLUploadInput({ slug, input, req })
80
+ }
81
+
78
82
  const uploadConfig = req.payload.collections[slug]?.config.upload
79
83
 
80
84
  if (!uploadConfig) {
@@ -82,48 +86,12 @@ export async function resolveFile({
82
86
  }
83
87
 
84
88
  const maxFileSize = req.payload.config.upload.limits?.fileSize
85
- let file: File
86
-
87
- if (input.source === 'base64') {
88
- const data = decodeBase64({ maxFileSize, value: input.data })
89
-
90
- file = {
91
- name: sanitizeFilename(input.name),
92
- data,
93
- mimetype: input.mimeType,
94
- size: data.length,
95
- }
96
- } else {
97
- if (uploadConfig.pasteURL === false) {
98
- throw new APIError(`Uploading files from URLs is disabled for collection "${slug}".`, 400)
99
- }
100
-
101
- const url = new URL(input.url)
102
-
103
- if (!['http:', 'https:'].includes(url.protocol)) {
104
- throw new APIError('File URLs must use http or https.', 400)
105
- }
106
-
107
- if (
108
- typeof uploadConfig.pasteURL === 'object' &&
109
- !isURLAllowed(input.url, uploadConfig.pasteURL.allowList)
110
- ) {
111
- throw new APIError('The provided file URL is not allowed.', 400)
112
- }
113
-
114
- file = await getExternalFile({
115
- data: {
116
- filename: sanitizeFilename(input.name || getURLFilename(url)),
117
- url: input.url,
118
- } as FileData,
119
- req,
120
- uploadConfig: {
121
- ...uploadConfig,
122
- externalFileHeaderFilter: uploadConfig.externalFileHeaderFilter ?? (() => ({})),
123
- },
124
- })
125
- file.mimetype = file.mimetype?.split(';')[0] || 'application/octet-stream'
126
- file.size = file.data.length
89
+ const data = decodeBase64({ maxFileSize, value: input.data })
90
+ const file: File = {
91
+ name: sanitizeFilename(input.name),
92
+ data,
93
+ mimetype: input.mimeType,
94
+ size: data.length,
127
95
  }
128
96
 
129
97
  if (maxFileSize !== undefined && Number.isFinite(maxFileSize) && file.size > maxFileSize) {
@@ -157,13 +125,3 @@ function decodeBase64({ maxFileSize, value }: { maxFileSize?: number; value: str
157
125
 
158
126
  return data
159
127
  }
160
-
161
- function getURLFilename(url: URL): string {
162
- const pathSegment = url.pathname.split('/').pop() || 'upload'
163
-
164
- try {
165
- return decodeURIComponent(pathSegment)
166
- } catch {
167
- return pathSegment
168
- }
169
- }
@@ -1,4 +1,4 @@
1
- import { findDocumentsInputSchema } from 'payload'
1
+ import { findDocumentsInputSchema, parseDocumentID } from 'payload'
2
2
 
3
3
  import { defaultAccess } from '../../../defaultAccess.js'
4
4
  import { defineCollectionTool } from '../../../defineTool.js'
@@ -45,10 +45,10 @@ export const findDocumentsTool = defineCollectionTool({
45
45
  )
46
46
 
47
47
  try {
48
- if (id) {
48
+ if (id !== undefined) {
49
49
  try {
50
50
  const doc = await payload.findByID({
51
- id,
51
+ id: parseDocumentID({ id, collectionSlug: slug, payload }),
52
52
  collection: slug,
53
53
  depth,
54
54
  overrideAccess: authorizedMCP.overrideAccess,
@@ -1,4 +1,5 @@
1
1
  import { getAccessResults, getCollectionInputSchema, getCollectionSchemaInputSchema } from 'payload'
2
+ import { getLLMInstructions } from 'payload/internal'
2
3
 
3
4
  import { defaultAccess } from '../../../defaultAccess.js'
4
5
  import { defineCollectionTool } from '../../../defineTool.js'
@@ -16,7 +17,8 @@ export const getCollectionSchemaTool = defineCollectionTool({
16
17
  readOnlyHint: true,
17
18
  title: 'Get Collection Schema',
18
19
  },
19
- description: 'Get the input schema for creating or updating documents in a collection.',
20
+ description:
21
+ 'Get the input schema and LLM instructions before creating or updating documents in a collection.',
20
22
  input: getCollectionSchemaInputSchema,
21
23
  }).handler(async ({ slug, authorizedMCP, req }) => {
22
24
  const permissions = authorizedMCP.overrideAccess
@@ -64,17 +66,26 @@ export const getCollectionSchemaTool = defineCollectionTool({
64
66
  }
65
67
  : { enabled: false }
66
68
 
69
+ const instructions = await getLLMInstructions({
70
+ slug,
71
+ type: 'collection',
72
+ overrideAccess: authorizedMCP.overrideAccess,
73
+ req,
74
+ })
75
+
67
76
  return {
68
77
  content: [
69
78
  {
70
79
  type: 'text',
71
80
  text: `Schema for collection "${slug}":\n\`\`\`json\n${JSON.stringify(inputSchema)}\n\`\`\`\nUpload configuration:\n\`\`\`json\n${JSON.stringify(upload)}\n\`\`\``,
72
81
  },
82
+ ...(instructions ? [{ type: 'text' as const, text: instructions }] : []),
73
83
  ],
74
84
  structuredContent: {
75
85
  slug,
76
86
  schema: inputSchema,
77
87
  upload,
88
+ ...(instructions ? { instructions } : {}),
78
89
  },
79
90
  }
80
91
  })
@@ -3,6 +3,7 @@ import type { Where } from 'payload'
3
3
  import {
4
4
  getCollectionInputSchema,
5
5
  getCollectionVirtualFieldNames,
6
+ parseDocumentID,
6
7
  stripVirtualFields,
7
8
  transformPointDataToPayload,
8
9
  updateDocumentInputSchema,
@@ -75,7 +76,7 @@ export const updateDocumentTool = defineCollectionTool({
75
76
 
76
77
  if (id !== undefined) {
77
78
  const result = await payload.update({
78
- id,
79
+ id: parseDocumentID({ id, collectionSlug: slug, payload }),
79
80
  collection: slug,
80
81
  data: parsedData,
81
82
  depth,
@@ -1,4 +1,5 @@
1
1
  import { getAccessResults, getGlobalInputSchema, getGlobalSchemaInputSchema } from 'payload'
2
+ import { getLLMInstructions } from 'payload/internal'
2
3
 
3
4
  import { defaultAccess } from '../../../defaultAccess.js'
4
5
  import { defineGlobalTool } from '../../../defineTool.js'
@@ -16,7 +17,7 @@ export const getGlobalSchemaTool = defineGlobalTool({
16
17
  readOnlyHint: true,
17
18
  title: 'Get Global Schema',
18
19
  },
19
- description: 'Get the input schema for updating a global.',
20
+ description: 'Get the input schema and LLM instructions before updating a global.',
20
21
  input: getGlobalSchemaInputSchema,
21
22
  }).handler(async ({ slug, authorizedMCP, req }) => {
22
23
  const permissions = authorizedMCP.overrideAccess
@@ -48,16 +49,25 @@ export const getGlobalSchemaTool = defineGlobalTool({
48
49
  }
49
50
  }
50
51
 
52
+ const instructions = await getLLMInstructions({
53
+ slug,
54
+ type: 'global',
55
+ overrideAccess: authorizedMCP.overrideAccess,
56
+ req,
57
+ })
58
+
51
59
  return {
52
60
  content: [
53
61
  {
54
62
  type: 'text',
55
63
  text: `Schema for global "${slug}":\n\`\`\`json\n${JSON.stringify(inputSchema)}\n\`\`\``,
56
64
  },
65
+ ...(instructions ? [{ type: 'text' as const, text: instructions }] : []),
57
66
  ],
58
67
  structuredContent: {
59
68
  slug,
60
69
  schema: inputSchema,
70
+ ...(instructions ? { instructions } : {}),
61
71
  },
62
72
  }
63
73
  })
package/src/stdio.ts CHANGED
@@ -3,7 +3,7 @@ import type { Config, Plugin, SanitizedConfig } from 'payload'
3
3
  /* eslint-disable no-console */
4
4
  import { serveStdio } from '@modelcontextprotocol/server/stdio'
5
5
  import { fileURLToPath, pathToFileURL } from 'node:url'
6
- import { createLocalReq, getPayload } from 'payload'
6
+ import { createPayloadRequest, getPayload } from 'payload'
7
7
  import { findConfig, loadEnv } from 'payload/node'
8
8
 
9
9
  import type { SanitizedMCPPluginConfig } from './types.js'
@@ -91,7 +91,7 @@ export const runMcpStdio = async (): Promise<void> => {
91
91
  headers.set('Authorization', process.env.PAYLOAD_MCP_AUTHORIZATION)
92
92
  }
93
93
 
94
- const req = await createLocalReq({ req: { headers } }, payload)
94
+ const req = await createPayloadRequest({ payload, req: { headers } })
95
95
  req.payloadAPI = 'MCP' as const
96
96
  const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })
97
97
 
package/src/types.ts CHANGED
@@ -1,8 +1,9 @@
1
1
  import type {
2
2
  CallToolResult,
3
3
  ContentBlock,
4
+ Implementation,
4
5
  JsonSchemaType,
5
- McpServer,
6
+ McpServerOptions,
6
7
  ResourceTemplate,
7
8
  ServerContext,
8
9
  StandardSchemaWithJSON,
@@ -279,6 +280,13 @@ export type MCPPluginConfig = {
279
280
  afterToolCall?: MCPAfterToolCallHook[]
280
281
  }
281
282
  mcp?: {
283
+ /**
284
+ * Largest HTTP request body, in bytes, that the MCP endpoint accepts. Larger requests
285
+ * are answered with `413`. Base64 file uploads count toward this limit.
286
+ *
287
+ * @default 4194304 (4 MiB, the MCP SDK default)
288
+ */
289
+ maxRequestBodySize?: number
282
290
  serverOptions?: MCPServerOptions
283
291
  verboseLogs?: boolean
284
292
  }
@@ -304,8 +312,8 @@ export type SanitizedMCPPluginConfig = {
304
312
  } & Pick<MCPPluginConfig, 'disabled' | 'hooks' | 'mcp' | 'overrideGetAuthorizedMCP'>
305
313
 
306
314
  export type MCPServerOptions = {
307
- options?: ConstructorParameters<typeof McpServer>[1]
308
- serverInfo?: Partial<ConstructorParameters<typeof McpServer>[0]>
315
+ options?: McpServerOptions
316
+ serverInfo?: Partial<Implementation>
309
317
  }
310
318
 
311
319
  /**
@@ -1,86 +0,0 @@
1
- import { describe, expect, it } from 'vitest';
2
- import { fileInputSchema, resolveFile } from './fileInput.js';
3
- describe('MCP file input', ()=>{
4
- it('should reject malformed MIME types', ()=>{
5
- const result = fileInputSchema.safeParse({
6
- data: 'aGVsbG8=',
7
- mimeType: 'text/plain\r\nx-test: value',
8
- name: 'hello.txt',
9
- source: 'base64'
10
- });
11
- expect(result.success).toBe(false);
12
- });
13
- it('should accept a prepared upload', ()=>{
14
- const result = fileInputSchema.safeParse({
15
- file: {
16
- filename: 'image.png',
17
- mimeType: 'image/png',
18
- size: 123,
19
- uploadReference: {
20
- uploadId: 'upload-id'
21
- }
22
- },
23
- source: 'uploadReference'
24
- });
25
- expect(result.success).toBe(true);
26
- });
27
- it('should reject oversized base64 files', async ()=>{
28
- const req = createRequest({
29
- maxFileSize: 4
30
- });
31
- await expect(resolveFile({
32
- slug: 'media',
33
- input: {
34
- data: Buffer.from('hello').toString('base64'),
35
- mimeType: 'text/plain',
36
- name: 'hello.txt',
37
- source: 'base64'
38
- },
39
- req
40
- })).rejects.toThrow('File exceeds the 4 byte upload limit.');
41
- });
42
- it('should reject URLs outside the collection allowlist', async ()=>{
43
- const req = createRequest({
44
- allowList: [
45
- {
46
- hostname: 'assets.example.com',
47
- protocol: 'https'
48
- }
49
- ]
50
- });
51
- await expect(resolveFile({
52
- slug: 'media',
53
- input: {
54
- source: 'externalURL',
55
- url: 'https://example.com/image.png'
56
- },
57
- req
58
- })).rejects.toThrow('The provided file URL is not allowed.');
59
- });
60
- });
61
- function createRequest({ allowList, maxFileSize }) {
62
- return {
63
- payload: {
64
- collections: {
65
- media: {
66
- config: {
67
- upload: allowList ? {
68
- pasteURL: {
69
- allowList
70
- }
71
- } : {}
72
- }
73
- }
74
- },
75
- config: {
76
- upload: {
77
- limits: {
78
- fileSize: maxFileSize
79
- }
80
- }
81
- }
82
- }
83
- };
84
- }
85
-
86
- //# sourceMappingURL=fileInput.spec.js.map
@@ -1 +0,0 @@
1
- {"version":3,"sources":["../../../../src/mcp/builtin/collections/fileInput.spec.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { describe, expect, it } from 'vitest'\n\nimport { fileInputSchema, resolveFile } from './fileInput.js'\n\ndescribe('MCP file input', () => {\n it('should reject malformed MIME types', () => {\n const result = fileInputSchema.safeParse({\n data: 'aGVsbG8=',\n mimeType: 'text/plain\\r\\nx-test: value',\n name: 'hello.txt',\n source: 'base64',\n })\n\n expect(result.success).toBe(false)\n })\n\n it('should accept a prepared upload', () => {\n const result = fileInputSchema.safeParse({\n file: {\n filename: 'image.png',\n mimeType: 'image/png',\n size: 123,\n uploadReference: { uploadId: 'upload-id' },\n },\n source: 'uploadReference',\n })\n\n expect(result.success).toBe(true)\n })\n\n it('should reject oversized base64 files', async () => {\n const req = createRequest({ maxFileSize: 4 })\n\n await expect(\n resolveFile({\n slug: 'media',\n input: {\n data: Buffer.from('hello').toString('base64'),\n mimeType: 'text/plain',\n name: 'hello.txt',\n source: 'base64',\n },\n req,\n }),\n ).rejects.toThrow('File exceeds the 4 byte upload limit.')\n })\n\n it('should reject URLs outside the collection allowlist', async () => {\n const req = createRequest({\n allowList: [{ hostname: 'assets.example.com', protocol: 'https' }],\n })\n\n await expect(\n resolveFile({\n slug: 'media',\n input: {\n source: 'externalURL',\n url: 'https://example.com/image.png',\n },\n req,\n }),\n ).rejects.toThrow('The provided file URL is not allowed.')\n })\n})\n\nfunction createRequest({\n allowList,\n maxFileSize,\n}: {\n allowList?: Array<{ hostname: string; protocol: 'http' | 'https' }>\n maxFileSize?: number\n}): PayloadRequest {\n return {\n payload: {\n collections: {\n media: {\n config: {\n upload: allowList ? { pasteURL: { allowList } } : {},\n },\n },\n },\n config: {\n upload: {\n limits: {\n fileSize: maxFileSize,\n },\n },\n },\n },\n } as unknown as PayloadRequest\n}\n"],"names":["describe","expect","it","fileInputSchema","resolveFile","result","safeParse","data","mimeType","name","source","success","toBe","file","filename","size","uploadReference","uploadId","req","createRequest","maxFileSize","slug","input","Buffer","from","toString","rejects","toThrow","allowList","hostname","protocol","url","payload","collections","media","config","upload","pasteURL","limits","fileSize"],"mappings":"AAEA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,eAAe,EAAEC,WAAW,QAAQ,iBAAgB;AAE7DJ,SAAS,kBAAkB;IACzBE,GAAG,sCAAsC;QACvC,MAAMG,SAASF,gBAAgBG,SAAS,CAAC;YACvCC,MAAM;YACNC,UAAU;YACVC,MAAM;YACNC,QAAQ;QACV;QAEAT,OAAOI,OAAOM,OAAO,EAAEC,IAAI,CAAC;IAC9B;IAEAV,GAAG,mCAAmC;QACpC,MAAMG,SAASF,gBAAgBG,SAAS,CAAC;YACvCO,MAAM;gBACJC,UAAU;gBACVN,UAAU;gBACVO,MAAM;gBACNC,iBAAiB;oBAAEC,UAAU;gBAAY;YAC3C;YACAP,QAAQ;QACV;QAEAT,OAAOI,OAAOM,OAAO,EAAEC,IAAI,CAAC;IAC9B;IAEAV,GAAG,wCAAwC;QACzC,MAAMgB,MAAMC,cAAc;YAAEC,aAAa;QAAE;QAE3C,MAAMnB,OACJG,YAAY;YACViB,MAAM;YACNC,OAAO;gBACLf,MAAMgB,OAAOC,IAAI,CAAC,SAASC,QAAQ,CAAC;gBACpCjB,UAAU;gBACVC,MAAM;gBACNC,QAAQ;YACV;YACAQ;QACF,IACAQ,OAAO,CAACC,OAAO,CAAC;IACpB;IAEAzB,GAAG,uDAAuD;QACxD,MAAMgB,MAAMC,cAAc;YACxBS,WAAW;gBAAC;oBAAEC,UAAU;oBAAsBC,UAAU;gBAAQ;aAAE;QACpE;QAEA,MAAM7B,OACJG,YAAY;YACViB,MAAM;YACNC,OAAO;gBACLZ,QAAQ;gBACRqB,KAAK;YACP;YACAb;QACF,IACAQ,OAAO,CAACC,OAAO,CAAC;IACpB;AACF;AAEA,SAASR,cAAc,EACrBS,SAAS,EACTR,WAAW,EAIZ;IACC,OAAO;QACLY,SAAS;YACPC,aAAa;gBACXC,OAAO;oBACLC,QAAQ;wBACNC,QAAQR,YAAY;4BAAES,UAAU;gCAAET;4BAAU;wBAAE,IAAI,CAAC;oBACrD;gBACF;YACF;YACAO,QAAQ;gBACNC,QAAQ;oBACNE,QAAQ;wBACNC,UAAUnB;oBACZ;gBACF;YACF;QACF;IACF;AACF"}