@payloadcms/plugin-mcp 4.0.0-internal.9496957 → 4.0.0-internal.970009e

package/src/index.ts

@@ -1,8 +1,18 @@
 import { definePlugin } from 'payload'
 
-import type { AuthorizedMCP, MCPPluginConfig, SanitizedMCPPluginConfig } from './types.js'
+import type {
+  AuthorizedMCP,
+  MCPBuiltinOAuthConfig,
+  MCPExternalOAuthConfig,
+  MCPOAuthConfig,
+  MCPOAuthTokens,
+  MCPPluginConfig,
+  SanitizedMCPPluginConfig,
+} from './types.js'
 
 import { mcpEndpoint } from './endpoint/index.js'
+import { oauthProtectedResourceEndpoint } from './endpoint/oauth.js'
+import { oauthServerEndpoints } from './endpoint/oauthServer.js'
 import { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'
 
 declare module 'payload' {
@@ -13,11 +23,27 @@ declare module 'payload' {
     /** After the plugin's `plugin` callback runs, `options` holds the sanitized config. */
     '@payloadcms/plugin-mcp': MCPPluginConfig
   }
+  export interface RequestContext {
+    /** Set on MCP requests before they're authenticated. */
+    mcp?: {
+      /** The MCP endpoint's address, which OAuth access tokens for MCP are issued for. */
+      resource: string
+    }
+  }
 }
 
-export type { AuthorizedMCP, MCPPluginConfig, SanitizedMCPPluginConfig }
+export type {
+  AuthorizedMCP,
+  MCPBuiltinOAuthConfig,
+  MCPExternalOAuthConfig,
+  MCPOAuthConfig,
+  MCPOAuthTokens,
+  MCPPluginConfig,
+  SanitizedMCPPluginConfig,
+}
 
 export { defineCollectionTool, defineGlobalTool, definePrompt, defineTool } from './defineTool.js'
+export { oauthProtectedResourceHandler } from './endpoint/oauth.js'
 
 export const mcpPlugin = definePlugin<MCPPluginConfig>({
   slug: '@payloadcms/plugin-mcp',
@@ -29,7 +55,7 @@ export const mcpPlugin = definePlugin<MCPPluginConfig>({
     const registered = plugins['@payloadcms/plugin-mcp']
     if (registered) {
       // @ts-expect-error
-      registered.sanitizedOptions = pluginConfig as unknown as typeof registered.options
+      registered.sanitizedOptions = pluginConfig
     }
 
     if (pluginConfig.disabled) {
@@ -40,15 +66,24 @@ export const mcpPlugin = definePlugin<MCPPluginConfig>({
       ...config,
       endpoints: [
         ...(config.endpoints ?? []),
-        // Payload prefixes /api, so the full path is /api/mcp.
-        { handler: mcpEndpoint, method: 'post', path: '/mcp' },
+        // Payload prefixes /api, so the full path is /api/mcp. getAuthorizedMCP authenticates the
+        // request with dev auto-login turned off, so Payload doesn't authenticate it first.
+        { disableAuth: true, handler: mcpEndpoint, method: 'post', path: '/mcp' },
         // Streamable HTTP's optional server=>client GET stream. We don't offer
         // one, so answer 405 per spec-— clients then skip it cleanly
         {
+          disableAuth: true,
           handler: () => new Response(null, { headers: { Allow: 'POST' }, status: 405 }),
           method: 'get',
           path: '/mcp',
         },
+        {
+          disableAuth: true,
+          handler: oauthProtectedResourceEndpoint,
+          method: 'get',
+          path: '/mcp/oauth-protected-resource',
+        },
+        ...oauthServerEndpoints,
       ],
     }
   },

package/src/mcp/buildMcpServer.ts

@@ -17,8 +17,6 @@ import type {
 import { getLogger } from '../utils/getLogger.js'
 import { toStandardSchema } from '../utils/toStandardSchema.js'
 
-z.config(z.locales.en())
-
 /**
  * Serving-entry-agnostic core: registers every authorized MCP item onto a fresh
  * `McpServer` and returns it. The HTTP and stdio entry point callers provide fresh
@@ -27,7 +25,7 @@ z.config(z.locales.en())
  *
  * `req` is the request context handlers see. For HTTP it's the live
  * `PayloadRequest` derived from the incoming HTTP request; for stdio it's a
- * synthesized one built via `createLocalReq`.
+ * synthesized one built via `createPayloadRequest`.
  */
 export const buildMcpServer = ({
   authorizedMCP,
@@ -38,6 +36,8 @@ export const buildMcpServer = ({
   pluginConfig: SanitizedMCPPluginConfig
   req: PayloadRequest
 }): McpServer => {
+  z.config(z.locales.en())
+
   const serverOptions = pluginConfig.mcp?.serverOptions || {}
   const server = new McpServer(
     { name: 'Payload MCP Server', version: '1.0.0', ...serverOptions.serverInfo },
@@ -250,7 +250,7 @@ const withSlugInput = ({ input }: { input?: ToolInputSchema }): ToolInputSchema
   const slugSchema = z.string().check(z.describe(description))
 
   if (!input) {
-    return strictObject({ slug: slugSchema }) as unknown as ToolInputSchema
+    return strictObject({ slug: slugSchema })
   }
 
   if (typeof input === 'object' && input !== null && '~standard' in input) {
@@ -261,7 +261,7 @@ const withSlugInput = ({ input }: { input?: ToolInputSchema }): ToolInputSchema
       return input
     }
 
-    return addSlugToJSONSchema({ description, schema: schema as JsonSchemaType })
+    return addSlugToJSONSchema({ description, schema })
   }
 
   return addSlugToJSONSchema({ description, schema: input })

package/src/mcp/builtin/collections/authTools.ts

@@ -1,4 +1,4 @@
-import { createLocalReq, strictObject, z } from 'payload'
+import { createPayloadRequest, strictObject, z } from 'payload'
 
 import type { MCPToolResponse } from '../../../types.js'
 
@@ -53,7 +53,10 @@ export const authCollectionTool = defineCollectionTool({
     if (input.headers) {
       authHeaders = new Headers(input.headers)
     }
-    const authReq = await createLocalReq({ req: { headers: authHeaders } }, req.payload)
+    const authReq = await createPayloadRequest({
+      payload: req.payload,
+      req: { headers: authHeaders },
+    })
     const result = await req.payload.auth({ headers: authHeaders, req: authReq })
 
     if (result.user) {
@@ -232,7 +235,7 @@ export const unlockCollectionTool = defineCollectionTool({
           text: `# Account Unlocked\n\n**Collection:** ${slug}\n**Email:** ${input.email}\n**Result:** ${result ? 'Success' : 'Failed'}`,
         },
       ],
-      doc: { result } as Record<string, unknown>,
+      doc: { result },
     }
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : 'Unknown error'
@@ -267,7 +270,7 @@ export const verifyCollectionTool = defineCollectionTool({
           text: `# Email Verification Successful\n\n**Collection:** ${slug}\n**Result:** ${result ? 'Success' : 'Failed'}`,
         },
       ],
-      doc: { result } as Record<string, unknown>,
+      doc: { result },
     }
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : 'Unknown error'

package/src/mcp/builtin/collections/createTool.ts

@@ -1,6 +1,7 @@
 import {
   createDocumentsInputSchema,
   getCollectionVirtualFieldNames,
+  hasDraftValidationEnabled,
   stripVirtualFields,
   transformPointDataToPayload,
   validateCollectionData,
@@ -29,22 +30,41 @@ export const createDocumentsTool = defineCollectionTool({
   input: createDocumentsInputSchema({ file: fileInputSchema }),
 }).handler(async ({ slug, authorizedMCP, input, req }) => {
   const payload = req.payload
+  const collectionConfig = payload.collections[slug]?.config
   const logger = getLogger({ payload })
-  const { depth, documents, draft, fallbackLocale, locale, populate, publishAllLocales, select } =
-    input
+  const {
+    depth,
+    documents,
+    draft,
+    fallbackLocale,
+    locale,
+    populate,
+    publishAllLocales,
+    returning,
+    select,
+  } = input
+  const shouldUsePartialSchema =
+    draft === true && collectionConfig !== undefined && !hasDraftValidationEnabled(collectionConfig)
 
   logger.info(`Creating ${documents.length} documents in collection: ${slug}`)
 
   try {
     const virtualFieldNames = getCollectionVirtualFieldNames(payload.config, slug)
-    const docs: Array<{ doc: Record<string, unknown>; index: number }> = []
+    const docs: Array<
+      { doc: Record<string, unknown>; index: number } | { id: number | string; index: number }
+    > = []
     const errors: Array<{ index: number; message: string }> = []
     let validationSchema: Record<string, unknown> | undefined
 
     for (const [index, document] of documents.entries()) {
       try {
         const inputData = stripVirtualFields(document.data, virtualFieldNames)
-        validateCollectionData({ slug, data: inputData, req })
+        validateCollectionData({
+          slug,
+          data: inputData,
+          partial: shouldUsePartialSchema,
+          req,
+        })
 
         const parsedData = transformPointDataToPayload(inputData)
         const file = await resolveFile({ slug, input: document.file, req })
@@ -60,10 +80,10 @@ export const createDocumentsTool = defineCollectionTool({
           ...(file ? { file } : {}),
           ...(locale ? { locale } : {}),
           ...(fallbackLocale !== undefined ? { fallbackLocale } : {}),
-          ...(select ? { select } : {}),
+          select: returning ? select : { id: true },
         })
 
-        docs.push({ doc: result as Record<string, unknown>, index })
+        docs.push(returning ? { doc: result, index } : { id: result.id, index })
       } catch (error) {
         const message = error instanceof Error ? error.message : 'Unknown error'
         const formattedError = formatEntityError({

package/src/mcp/builtin/collections/deleteTool.ts

@@ -1,4 +1,4 @@
-import { deleteDocumentsInputSchema } from 'payload'
+import { deleteDocumentsInputSchema, parseDocumentID } from 'payload'
 
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
@@ -32,7 +32,7 @@ export const deleteDocumentsTool = defineCollectionTool({
   try {
     if (id !== undefined) {
       const result = await payload.delete({
-        id,
+        id: parseDocumentID({ id, collectionSlug: slug, payload }),
         collection: slug,
         depth,
         overrideAccess: authorizedMCP.overrideAccess,
@@ -48,7 +48,7 @@ export const deleteDocumentsTool = defineCollectionTool({
             text: `Document deleted successfully from collection "${slug}"!\nDeleted document:\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
           },
         ],
-        doc: result as Record<string, unknown>,
+        doc: result,
       }
     }
 

package/src/mcp/builtin/collections/duplicateTool.ts

@@ -1,6 +1,7 @@
 import {
   duplicateDocumentInputSchema,
   getCollectionVirtualFieldNames,
+  parseDocumentID,
   stripVirtualFields,
   transformPointDataToPayload,
   validateCollectionData,
@@ -50,7 +51,7 @@ export const duplicateDocumentTool = defineCollectionTool({
     const parsedData = inputData ? transformPointDataToPayload(inputData) : undefined
 
     const result = await payload.duplicate({
-      id,
+      id: parseDocumentID({ id, collectionSlug: slug, payload }),
       collection: slug,
       depth,
       draft,
@@ -73,7 +74,7 @@ export const duplicateDocumentTool = defineCollectionTool({
           text: `Document duplicated successfully in collection "${slug}"!\nDuplicated document:\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
         },
       ],
-      doc: result as Record<string, unknown>,
+      doc: result,
     }
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : 'Unknown error'

package/src/mcp/builtin/collections/fileInput.ts

@@ -1,7 +1,11 @@
-import type { CollectionSlug, File, FileData, PayloadRequest } from 'payload'
+import type { CollectionSlug, File, PayloadRequest } from 'payload'
 
 import { APIError, z } from 'payload'
-import { getExternalFile, getFileFromUploadInstructions, isURLAllowed } from 'payload/internal'
+import {
+  externalURLInputSchema,
+  getFileFromUploadInstructions,
+  resolveURLUploadInput,
+} from 'payload/internal'
 import { sanitizeFilename } from 'payload/shared'
 
 const mimeTypeSchema = z
@@ -30,11 +34,7 @@ export const fileInputSchema = z
       mimeType: mimeTypeSchema.check(z.describe('The file MIME type, for example image/png.')),
       source: z.literal('base64'),
     }),
-    z.strictObject({
-      name: z.optional(z.string().check(z.minLength(1))).check(z.describe('File name override.')),
-      source: z.literal('externalURL'),
-      url: z.url().check(z.describe('The http or https URL to download.')),
-    }),
+    externalURLInputSchema,
     z.strictObject({
       file: uploadFileSchema.check(z.describe('getUploadInstructions file field post-upload.')),
       source: z.literal('uploadReference'),
@@ -75,6 +75,10 @@ export async function resolveFile({
     }
   }
 
+  if (input.source === 'externalURL') {
+    return resolveURLUploadInput({ slug, input, req })
+  }
+
   const uploadConfig = req.payload.collections[slug]?.config.upload
 
   if (!uploadConfig) {
@@ -82,48 +86,12 @@ export async function resolveFile({
   }
 
   const maxFileSize = req.payload.config.upload.limits?.fileSize
-  let file: File
-
-  if (input.source === 'base64') {
-    const data = decodeBase64({ maxFileSize, value: input.data })
-
-    file = {
-      name: sanitizeFilename(input.name),
-      data,
-      mimetype: input.mimeType,
-      size: data.length,
-    }
-  } else {
-    if (uploadConfig.pasteURL === false) {
-      throw new APIError(`Uploading files from URLs is disabled for collection "${slug}".`, 400)
-    }
-
-    const url = new URL(input.url)
-
-    if (!['http:', 'https:'].includes(url.protocol)) {
-      throw new APIError('File URLs must use http or https.', 400)
-    }
-
-    if (
-      typeof uploadConfig.pasteURL === 'object' &&
-      !isURLAllowed(input.url, uploadConfig.pasteURL.allowList)
-    ) {
-      throw new APIError('The provided file URL is not allowed.', 400)
-    }
-
-    file = await getExternalFile({
-      data: {
-        filename: sanitizeFilename(input.name || getURLFilename(url)),
-        url: input.url,
-      } as FileData,
-      req,
-      uploadConfig: {
-        ...uploadConfig,
-        externalFileHeaderFilter: uploadConfig.externalFileHeaderFilter ?? (() => ({})),
-      },
-    })
-    file.mimetype = file.mimetype?.split(';')[0] || 'application/octet-stream'
-    file.size = file.data.length
+  const data = decodeBase64({ maxFileSize, value: input.data })
+  const file: File = {
+    name: sanitizeFilename(input.name),
+    data,
+    mimetype: input.mimeType,
+    size: data.length,
   }
 
   if (maxFileSize !== undefined && Number.isFinite(maxFileSize) && file.size > maxFileSize) {
@@ -157,13 +125,3 @@ function decodeBase64({ maxFileSize, value }: { maxFileSize?: number; value: str
 
   return data
 }
-
-function getURLFilename(url: URL): string {
-  const pathSegment = url.pathname.split('/').pop() || 'upload'
-
-  try {
-    return decodeURIComponent(pathSegment)
-  } catch {
-    return pathSegment
-  }
-}

package/src/mcp/builtin/collections/findTool.ts

@@ -1,4 +1,4 @@
-import { findDocumentsInputSchema } from 'payload'
+import { findDocumentsInputSchema, parseDocumentID } from 'payload'
 
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
@@ -45,10 +45,10 @@ export const findDocumentsTool = defineCollectionTool({
   )
 
   try {
-    if (id) {
+    if (id !== undefined) {
       try {
         const doc = await payload.findByID({
-          id,
+          id: parseDocumentID({ id, collectionSlug: slug, payload }),
           collection: slug,
           depth,
           overrideAccess: authorizedMCP.overrideAccess,
@@ -69,7 +69,7 @@ export const findDocumentsTool = defineCollectionTool({
               text: `Document from collection "${slug}":\n${JSON.stringify(doc)}`,
             },
           ],
-          doc: doc as Record<string, unknown>,
+          doc,
         }
       } catch {
         logger.warn(`Document not found with ID: ${id} in collection: ${slug}`)

package/src/mcp/builtin/collections/getCollectionSchemaTool.ts

@@ -1,4 +1,5 @@
 import { getAccessResults, getCollectionInputSchema, getCollectionSchemaInputSchema } from 'payload'
+import { getLLMInstructions } from 'payload/internal'
 
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
@@ -16,7 +17,8 @@ export const getCollectionSchemaTool = defineCollectionTool({
     readOnlyHint: true,
     title: 'Get Collection Schema',
   },
-  description: 'Get the input schema for creating or updating documents in a collection.',
+  description:
+    'Get the input schema and LLM instructions before creating or updating documents in a collection.',
   input: getCollectionSchemaInputSchema,
 }).handler(async ({ slug, authorizedMCP, req }) => {
   const permissions = authorizedMCP.overrideAccess
@@ -64,17 +66,26 @@ export const getCollectionSchemaTool = defineCollectionTool({
       }
     : { enabled: false }
 
+  const instructions = await getLLMInstructions({
+    slug,
+    type: 'collection',
+    overrideAccess: authorizedMCP.overrideAccess,
+    req,
+  })
+
   return {
     content: [
       {
         type: 'text',
         text: `Schema for collection "${slug}":\n\`\`\`json\n${JSON.stringify(inputSchema)}\n\`\`\`\nUpload configuration:\n\`\`\`json\n${JSON.stringify(upload)}\n\`\`\``,
       },
+      ...(instructions ? [{ type: 'text' as const, text: instructions }] : []),
     ],
     structuredContent: {
       slug,
       schema: inputSchema,
       upload,
+      ...(instructions ? { instructions } : {}),
     },
   }
 })

package/src/mcp/builtin/collections/restoreVersionTool.ts

@@ -47,7 +47,7 @@ export const restoreVersionTool = defineCollectionTool({
           text: `Version "${id}" restored successfully in collection "${slug}"!\nRestored document:\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
         },
       ],
-      doc: result as Record<string, unknown>,
+      doc: result,
     }
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : 'Unknown error'

package/src/mcp/builtin/collections/updateTool.ts

@@ -3,6 +3,7 @@ import type { Where } from 'payload'
 import {
   getCollectionInputSchema,
   getCollectionVirtualFieldNames,
+  parseDocumentID,
   stripVirtualFields,
   transformPointDataToPayload,
   updateDocumentInputSchema,
@@ -46,6 +47,7 @@ export const updateDocumentTool = defineCollectionTool({
     overrideLock,
     populate,
     publishAllLocales,
+    returning,
     select,
     sort,
     trash,
@@ -74,7 +76,7 @@ export const updateDocumentTool = defineCollectionTool({
 
     if (id !== undefined) {
       const result = await payload.update({
-        id,
+        id: parseDocumentID({ id, collectionSlug: slug, payload }),
         collection: slug,
         data: parsedData,
         depth,
@@ -86,20 +88,22 @@ export const updateDocumentTool = defineCollectionTool({
         populate,
         publishAllLocales,
         req,
-        select,
+        select: returning ? select : { id: true },
         trash,
         unpublishAllLocales,
         ...(file ? { file } : {}),
       })
 
+      const responseResult = returning ? result : { id: result.id }
+
       return {
         content: [
           {
             type: 'text',
-            text: `Document updated successfully in collection "${slug}"!\nUpdated document:\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
+            text: `Document updated successfully in collection "${slug}"!\nResult:\n\`\`\`json\n${JSON.stringify(responseResult)}\n\`\`\``,
           },
         ],
-        doc: result as Record<string, unknown>,
+        doc: responseResult,
       }
     }
 
@@ -116,7 +120,7 @@ export const updateDocumentTool = defineCollectionTool({
       populate,
       publishAllLocales,
       req,
-      select,
+      select: returning ? select : { id: true },
       sort,
       trash,
       unpublishAllLocales,
@@ -124,7 +128,7 @@ export const updateDocumentTool = defineCollectionTool({
       ...(file ? { file } : {}),
     })
 
-    const docs = result.docs || []
+    const docs = returning ? result.docs : result.docs.map(({ id }) => ({ id }))
     const errors = result.errors || []
 
     let responseText = `Multiple documents updated in collection "${slug}"!\nUpdated: ${docs.length} documents\nErrors: ${errors.length}\n---`

package/src/mcp/builtin/collections/uploadInstructionsTool.ts

@@ -9,7 +9,7 @@ export const getUploadInstructionsTool = defineCollectionTool({
     defaultAccess(args) &&
     Boolean(
       args.permissions?.collections?.[args.slug]?.create ||
-        args.permissions?.collections?.[args.slug]?.update,
+      args.permissions?.collections?.[args.slug]?.update,
     ),
   annotations: {
     destructiveHint: false,

package/src/mcp/builtin/globals/findTool.ts

@@ -54,7 +54,7 @@ export const findGlobalTool = defineGlobalTool({
           text: `Global "${slug}":\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
         },
       ],
-      doc: result as Record<string, unknown>,
+      doc: result,
     }
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : 'Unknown error'

package/src/mcp/builtin/globals/getGlobalSchemaTool.ts

@@ -1,4 +1,5 @@
 import { getAccessResults, getGlobalInputSchema, getGlobalSchemaInputSchema } from 'payload'
+import { getLLMInstructions } from 'payload/internal'
 
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
@@ -16,7 +17,7 @@ export const getGlobalSchemaTool = defineGlobalTool({
     readOnlyHint: true,
     title: 'Get Global Schema',
   },
-  description: 'Get the input schema for updating a global.',
+  description: 'Get the input schema and LLM instructions before updating a global.',
   input: getGlobalSchemaInputSchema,
 }).handler(async ({ slug, authorizedMCP, req }) => {
   const permissions = authorizedMCP.overrideAccess
@@ -48,16 +49,25 @@ export const getGlobalSchemaTool = defineGlobalTool({
     }
   }
 
+  const instructions = await getLLMInstructions({
+    slug,
+    type: 'global',
+    overrideAccess: authorizedMCP.overrideAccess,
+    req,
+  })
+
   return {
     content: [
       {
         type: 'text',
         text: `Schema for global "${slug}":\n\`\`\`json\n${JSON.stringify(inputSchema)}\n\`\`\``,
       },
+      ...(instructions ? [{ type: 'text' as const, text: instructions }] : []),
     ],
     structuredContent: {
       slug,
       schema: inputSchema,
+      ...(instructions ? { instructions } : {}),
     },
   }
 })

package/src/mcp/builtin/globals/updateTool.ts

@@ -82,7 +82,7 @@ export const updateGlobalTool = defineGlobalTool({
           text: `Global "${slug}" updated successfully!\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
         },
       ],
-      doc: result as Record<string, unknown>,
+      doc: result,
     }
   } catch (error) {
     const message = error instanceof Error ? error.message : 'Unknown error'

package/src/mcp/sanitizeMCPConfig.ts

@@ -103,6 +103,7 @@ export const sanitizeMCPConfig = ({
     hooks: pluginConfig.hooks,
     items,
     mcp: pluginConfig.mcp,
+    oauth: pluginConfig.oauth === false ? undefined : (pluginConfig.oauth ?? { type: 'builtin' }),
     overrideGetAuthorizedMCP: pluginConfig.overrideGetAuthorizedMCP,
   }
 }

package/src/stdio.ts

@@ -3,7 +3,7 @@ import type { Config, Plugin, SanitizedConfig } from 'payload'
 /* eslint-disable no-console */
 import { serveStdio } from '@modelcontextprotocol/server/stdio'
 import { fileURLToPath, pathToFileURL } from 'node:url'
-import { createLocalReq, getPayload } from 'payload'
+import { createPayloadRequest, getPayload } from 'payload'
 import { findConfig, loadEnv } from 'payload/node'
 
 import type { SanitizedMCPPluginConfig } from './types.js'
@@ -91,7 +91,7 @@ export const runMcpStdio = async (): Promise<void> => {
     headers.set('Authorization', process.env.PAYLOAD_MCP_AUTHORIZATION)
   }
 
-  const req = await createLocalReq({ req: { headers } }, payload)
+  const req = await createPayloadRequest({ payload, req: { headers } })
   req.payloadAPI = 'MCP' as const
   const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })