mcp-google-multi 6.0.0-alpha.30 → 6.0.0-alpha.32

package/dist/arg-normalize.d.ts

@@ -1,5 +1,4 @@
-import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
-import type { JSONRPCMessage } from '@modelcontextprotocol/sdk/types.js';
+import type { Transport, JSONRPCMessage } from "@modelcontextprotocol/server";
 export declare function argNormalizationEnabled(env?: NodeJS.ProcessEnv): boolean;
 /** Declared scalar kind per schema key; drives value coercion on RENAMED keys
  * only. Clients string-encode values for keys absent from the advertised

package/dist/arg-normalize.js

@@ -1,6 +1,6 @@
 // Wire-level tools/call argument normalization. Clients (LLMs) recurringly
 // snake_case a camelCase parameter (thread_id for threadId) and burn a retry
-// on the -32602. A schema-level fix is off the table: SDK 1.x advertises an
+// on the -32602. A schema-level fix is off the table: the SDK advertises an
 // EMPTY input schema for any non-object wrapper (pipe/preprocess), so the
 // only seam that keeps tools/list intact is the JSON-RPC message itself —
 // which is versioned MCP spec, stabler than any SDK internal. The rename is
@@ -90,5 +90,12 @@ export function withArgNormalization(transport, shapeFor, log, onRename) {
     if (transport.setProtocolVersion) {
         wrapper.setProtocolVersion = (v) => transport.setProtocolVersion(v);
     }
+    // v2-only, called by Protocol.connect() before start(). A no-op today (both
+    // sides default to the same exported constant), but a proxy that silently
+    // eats a member the SDK calls is a bug waiting for the first caller that
+    // passes supportedProtocolVersions explicitly.
+    if (transport.setSupportedProtocolVersions) {
+        wrapper.setSupportedProtocolVersions = (v) => transport.setSupportedProtocolVersions(v);
+    }
     return wrapper;
 }

package/dist/http-transport.d.ts

@@ -1,8 +1,7 @@
+import type { McpServer, Transport } from "@modelcontextprotocol/server";
 import { type IncomingMessage, type ServerResponse } from 'node:http';
-import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { HttpConfig } from './http-config.js';
 import { type ArgShape } from './arg-normalize.js';
-import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
 export type AuthOutcome = {
     ok: true;
 } | {

package/dist/http-transport.js

@@ -1,10 +1,9 @@
-// B12: the Streamable HTTP transport host (cc-transport-hosting T2/T3). Owns the
+import { NodeStreamableHTTPServerTransport } from "@modelcontextprotocol/node";
 // node:http server, the route table, the front guard (Host / Origin / DNS-rebind),
 // and the stateless per-request /mcp dispatch. The OAuth AS endpoints and Bearer
 // verification are a seam filled by B13 (oauth-authorization-server); B12 ships a
 // loopback-owner authenticator so the local-HTTP model works before the AS lands.
 import { createServer } from 'node:http';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { withArgNormalization } from './arg-normalize.js';
 // A hung handler that keeps the connection open would otherwise hold the global
 // serialize() lock forever. Generous by default so slow-but-valid calls (large
@@ -161,7 +160,7 @@ export class HttpTransportHost {
         // the mounted AS routes), so the SDK's own DNS-rebind guard is disabled: its
         // exact-Host match is stricter than the front guard and would 403 valid
         // Hosts (double enforcement, differing rules).
-        const transport = new StreamableHTTPServerTransport({
+        const transport = new NodeStreamableHTTPServerTransport({
             sessionIdGenerator: undefined,
             enableJsonResponse: true,
             enableDnsRebindingProtection: false,

package/dist/index.js

@@ -5,8 +5,8 @@ import { assertServerAccountsConfigured } from './accounts.js';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
+import { McpServer } from "@modelcontextprotocol/server";
 import { GENERATED_SERVICES } from './tools/generated/index.js';
 import { GENERATED_GATES, SERVICES } from './services.js';
 import { ToolRegistry, resolveDiscoveryMode } from './registry.js';
@@ -247,7 +247,7 @@ async function main() {
         let transport = new StdioServerTransport();
         if (stdioMetrics) {
             const { tapUsageMetrics } = await import('./metrics-tap.js');
-            transport = tapUsageMetrics(transport, stdioMetrics);
+            transport = tapUsageMetrics(transport, stdioMetrics, (n) => registry.hasTool(n));
         }
         await server.connect(argNormalizationEnabled()
             ? withArgNormalization(transport, (n) => registry.argShape(n), undefined, stdioMetrics ? (tool, n) => stdioMetrics.recordArgFix(tool, n) : undefined)
@@ -338,7 +338,7 @@ async function main() {
         let httpTap;
         if (httpMetrics) {
             const { tapUsageMetrics } = await import('./metrics-tap.js');
-            httpTap = (t) => tapUsageMetrics(t, httpMetrics);
+            httpTap = (t) => tapUsageMetrics(t, httpMetrics, (n) => registry.hasTool(n));
         }
         const host = new HttpTransportHost({
             server: httpServer,

package/dist/metrics-tap.d.ts

@@ -1,3 +1,11 @@
-import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+import type { Transport } from "@modelcontextprotocol/server";
 import type { Metrics } from './usage-metrics.js';
-export declare function tapUsageMetrics(transport: Transport, metrics: Metrics): Transport;
+export declare function isSchemaValidationText(text: string): boolean;
+/**
+ * @param isKnownTool membership test against the REGISTERED tool set. The
+ * name on a `tools/call` frame is client-supplied, so a shape check alone
+ * would let a shape-valid but invented name reach disk and break the
+ * closed-vocabulary guarantee. A validation failure against a name the server
+ * never registered is a not-found, and is counted as one.
+ */
+export declare function tapUsageMetrics(transport: Transport, metrics: Metrics, isKnownTool?: (name: string) => boolean): Transport;

package/dist/metrics-tap.js

@@ -1,6 +1,28 @@
 const PENDING_CAP = 1_000;
-export function tapUsageMetrics(transport, metrics) {
+// The SDK synthesizes input-validation failures as isError RESULTS, skipping
+// the handler entirely, so neither the registry wrapper nor the error-frame
+// path sees them. The text is prose in both SDK eras (v1 prefixed it with
+// "MCP error -32602: ", v2 dropped that prefix), while handler envelopes are
+// always JSON starting with "{" — so this can never double count one.
+const SCHEMA_VALIDATION_TEXT = /^(MCP error -32602: )?Input validation error:/;
+export function isSchemaValidationText(text) {
+    return SCHEMA_VALIDATION_TEXT.test(text);
+}
+/**
+ * @param isKnownTool membership test against the REGISTERED tool set. The
+ * name on a `tools/call` frame is client-supplied, so a shape check alone
+ * would let a shape-valid but invented name reach disk and break the
+ * closed-vocabulary guarantee. A validation failure against a name the server
+ * never registered is a not-found, and is counted as one.
+ */
+export function tapUsageMetrics(transport, metrics, isKnownTool = () => false) {
     const pending = new Map();
+    const recordValidation = (tool) => {
+        if (tool !== undefined && isKnownTool(tool))
+            metrics.recordRpc('schema_validation', tool);
+        else
+            metrics.recordRpc('tool_not_found');
+    };
     const wrapper = {
         start: () => transport.start(),
         send: (message, options) => {
@@ -14,23 +36,16 @@ export function tapUsageMetrics(transport, metrics) {
                             if (/unknown tool|not found/i.test(m.error.message ?? ''))
                                 metrics.recordRpc('tool_not_found');
                             else
-                                metrics.recordRpc('schema_validation', tool);
+                                recordValidation(tool);
                         }
                         else {
                             metrics.recordRpc(m.error.code);
                         }
                     }
                     else if (m.result?.isError === true) {
-                        // SDK 1.x synthesizes input-validation failures as isError RESULTS
-                        // ("MCP error -32602: ..."), skipping the handler entirely, so the
-                        // registry wrapper never sees them either. Handler envelopes are
-                        // JSON text and never carry this prefix, so nothing double counts.
                         const first = m.result.content?.[0]?.text;
-                        if (typeof first === 'string' && first.startsWith('MCP error -32602:')) {
-                            if (/tool \S+ not found|unknown tool/i.test(first))
-                                metrics.recordRpc('tool_not_found');
-                            else
-                                metrics.recordRpc('schema_validation', tool);
+                        if (typeof first === 'string' && isSchemaValidationText(first)) {
+                            recordValidation(tool);
                         }
                     }
                 }
@@ -71,5 +86,10 @@ export function tapUsageMetrics(transport, metrics) {
     if (transport.setProtocolVersion) {
         wrapper.setProtocolVersion = (v) => transport.setProtocolVersion(v);
     }
+    // v2-only; see the same forward in arg-normalize.ts. Both proxies compose,
+    // so a member dropped by either layer never reaches the real transport.
+    if (transport.setSupportedProtocolVersions) {
+        wrapper.setSupportedProtocolVersions = (v) => transport.setSupportedProtocolVersions(v);
+    }
     return wrapper;
 }

package/dist/registry.d.ts

@@ -1,4 +1,4 @@
-import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { McpServer } from "@modelcontextprotocol/server";
 import { z } from 'zod';
 import { type Policy } from './write-control.js';
 import type { ArgShape } from './arg-normalize.js';
@@ -58,6 +58,10 @@ export declare class ToolRegistry {
     catalog(service: string, query?: string): CatalogOperation[];
     /** The metrics recorder, for hook sites (escape hatch); null when off. */
     get usageMetrics(): Metrics | null;
+    /** Membership test against the REGISTERED tool set (hidden tools included:
+     * they stay callable). The metrics tap uses this so a client-supplied name
+     * can never enter the closed vocabulary. */
+    hasTool(name: string): boolean;
     /** Op-name vocabulary for a service, split by provenance so the capped
      * discover descriptions can list curated ops and only summarize the
      * generated long tail. */

package/dist/registry.js

@@ -1,4 +1,3 @@
-import { ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { z } from 'zod';
 import { isAllowed, writeDisabledResult, IRREVERSIBLE_TOOLS } from './write-control.js';
 import { getAccountSet, refreshAccountSetIfStale } from './accounts.js';
@@ -256,6 +255,12 @@ export class ToolRegistry {
     get usageMetrics() {
         return this.metrics;
     }
+    /** Membership test against the REGISTERED tool set (hidden tools included:
+     * they stay callable). The metrics tap uses this so a client-supplied name
+     * can never enter the closed vocabulary. */
+    hasTool(name) {
+        return this.tools.some((t) => t.name === name);
+    }
     /** Op-name vocabulary for a service, split by provenance so the capped
      * discover descriptions can list curated ops and only summarize the
      * generated long tail. */
@@ -320,7 +325,11 @@ export class ToolRegistry {
         if (this.tools.length === 0) {
             throw new Error('installListHandler() requires at least one registered tool');
         }
-        this.server.server.setRequestHandler(ListToolsRequestSchema, async () => ({
+        this.server.server.setRequestHandler('tools/list', async () => ({
+            // The wire Tool is hand-built because the SDK's own types drop the
+            // anthropic/* _meta keys honoring clients read. z.toJSONSchema emits a
+            // valid draft-7 object schema by construction, which the SDK's recursive
+            // JSON-Schema type cannot infer from our cached `unknown`.
             tools: this.tools.filter((t) => this.isVisible(t)).map((t) => this.toToolJson(t)),
         }));
     }

package/dist/setup-prompt.d.ts

@@ -1,4 +1,4 @@
-import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { McpServer } from "@modelcontextprotocol/server";
 export interface SetupOptions {
     /** Public base URL when serving over HTTP; used for the Web client redirect. */
     publicUrl?: string;

package/dist/setup-prompt.js

@@ -47,7 +47,7 @@ export function registerSetupPrompt(server) {
     server.registerPrompt('setup', {
         title: 'Set up mcp-google-multi',
         description: 'Guided Google Cloud Console prelude: project, APIs, consent screen, OAuth client, and credentials. The one-time browser setup that has no API.',
-        argsSchema: { publicUrl: z.string().optional().describe('Public base URL when serving over HTTP (for the Web OAuth client redirect). Omit for stdio.') },
+        argsSchema: z.object({ publicUrl: z.string().optional().describe('Public base URL when serving over HTTP (for the Web OAuth client redirect). Omit for stdio.') }),
     }, (args) => ({
         messages: [
             {

package/dist/tools/account-wizard.d.ts

@@ -1,4 +1,4 @@
-import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { McpServer } from "@modelcontextprotocol/server";
 import type { ToolRegistry } from '../registry.js';
 export interface AddForm {
     alias: string;
@@ -27,6 +27,16 @@ export type AddValidation = {
 /** Validate the collected form against the alias rules, dup check, and the
  * bundle catalog. Pure (no I/O) for unit testing. */
 export declare function validateAddForm(input: Partial<AddForm>, existingAliases: string[]): AddValidation;
+/** URL-mode elicitation params. `elicitationId` is REQUIRED by the spec
+ * schema; omitting it made every url-mode request fail client-side
+ * validation, so the branch silently never worked. Pure, so the shape is
+ * testable against the SDK's own schema without a live client. */
+export declare function urlElicitationParams(alias: string, url: string, elicitationId: string): {
+    mode: 'url';
+    elicitationId: string;
+    message: string;
+    url: string;
+};
 /** Map direct tool arguments onto the elicitation form shape: the argument-
  * mode fallback for clients without form elicitation. All bundle picks travel
  * through otherBundles, which validateAddForm resolves and validates. Pure. */

package/dist/tools/account-wizard.js

@@ -71,6 +71,18 @@ export function validateAddForm(input, existingAliases) {
     }
     return { ok: true, alias, email, bundles, admin: input.admin === true };
 }
+/** URL-mode elicitation params. `elicitationId` is REQUIRED by the spec
+ * schema; omitting it made every url-mode request fail client-side
+ * validation, so the branch silently never worked. Pure, so the shape is
+ * testable against the SDK's own schema without a live client. */
+export function urlElicitationParams(alias, url, elicitationId) {
+    return {
+        mode: 'url',
+        elicitationId,
+        message: `Authorize the "${alias}" Google account in your browser.`,
+        url,
+    };
+}
 /** Map direct tool arguments onto the elicitation form shape: the argument-
  * mode fallback for clients without form elicitation. All bundle picks travel
  * through otherBundles, which validateAddForm resolves and validates. Pure. */
@@ -125,11 +137,16 @@ async function runConsent(server, alias) {
     const scopes = resolveScopesForAccount(alias);
     const url = client.generateAuthUrl({ access_type: 'offline', prompt: 'consent', scope: scopes, login_hint: cfg.email, state: expectedState });
     const consent = loop.finish(client, expectedState);
+    // Capability probe: the spec advertises each elicitation mode as a PRESENT
+    // object, not a boolean, so test presence rather than truthiness.
     const caps = server.server.getClientCapabilities?.();
     let opened = false;
-    if (caps?.elicitation?.url) {
+    if (caps?.elicitation?.url !== undefined) {
         try {
-            const r = await server.server.elicitInput({ mode: 'url', message: `Authorize the "${alias}" Google account in your browser.`, url });
+            // elicitationId is REQUIRED by the spec schema; omitting it made every
+            // url-mode request fail client-side validation, so this branch always
+            // fell through to the server-side browser open.
+            const r = await server.server.elicitInput(urlElicitationParams(alias, url, randomBytes(16).toString('hex')));
             if (r.action !== 'accept') {
                 loop.close();
                 return { ok: false, text: 'confirmation_declined: consent was cancelled; the account row was kept but no token was stored (doctor will show it as "missing").' };
@@ -148,7 +165,9 @@ async function runConsent(server, alias) {
         tokens = await consent;
     }
     catch (e) {
-        return { ok: false, text: `${e.message}${opened ? '' : `\nOpen this URL to authorize:\n${url}`}` };
+        // Always surface the URL: the browser hand-off can succeed and consent
+        // still fail (declined, timed out), and the URL is the only recovery.
+        return { ok: false, text: `${e.message}\nOpen this URL to authorize:\n${url}` };
     }
     writeToken(alias, tokens);
     return { ok: true, missing: scopeGrantDiff(scopes, typeof tokens.scope === 'string' ? tokens.scope : undefined) };
@@ -196,15 +215,16 @@ export function registerAccountWizardTools(registry, server) {
                 input = argsToAddForm(a);
             }
             else {
+                // Modes are advertised as PRESENT objects, not booleans.
                 const caps = server.server.getClientCapabilities?.();
-                if (!caps?.elicitation?.form) {
+                if (caps?.elicitation?.form === undefined) {
                     return textResult('E_NO_FORM_ELICITATION: this client does not support the interactive form. Call account_add again with arguments instead, e.g. {"alias": "work", "email": "you@example.com"} (optional: "bundles" as a comma-separated list, "allBundles": true, "admin": true).', true);
                 }
                 const form = await server.server.elicitInput({ message: 'Add a Google account', requestedSchema: addFormSchema() });
                 if (form.action !== 'accept') {
                     return textResult('confirmation_declined: no account was added.');
                 }
-                input = form.content ?? {};
+                input = (form.content ?? {});
             }
             const validated = validateAddForm(input, getAccountSet().aliases);
             if (!validated.ok)

package/dist/usage-metrics.js

@@ -18,6 +18,7 @@ const RETRY_WINDOW_MS = 10 * 60_000;
 const BIGRAM_GAP_MS = 5 * 60_000;
 const BIGRAM_CAP = 1_500;
 const ERR_SLUG_CAP = 32;
+const VALIDATION_CAP = 200;
 const ESCAPE_CAP = 500;
 const EVENTS_ROTATE_BYTES = 4 * 1024 * 1024;
 const RETENTION_DAYS = 180;
@@ -184,6 +185,9 @@ function applyCaps(day) {
     };
     for (const t of Object.values(day.tools))
         t.err = cap(t.err, ERR_SLUG_CAP);
+    // Bounded by the registered tool set via the tap's membership test, but
+    // capped anyway: this map is the only one fed by a wire-supplied key.
+    day.validation = cap(day.validation, VALIDATION_CAP);
     day.escape.methods = cap(day.escape.methods, ESCAPE_CAP, (n) => { day.escape._overflow += n; });
     day.bigrams = cap(day.bigrams, BIGRAM_CAP, (n) => { day.bigrams._overflow = (day.bigrams._overflow ?? 0) + n; });
     return day;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.30",
+  "version": "6.0.0-alpha.32",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",
@@ -81,7 +81,8 @@
     "@googleapis/slides": "^10.0.0",
     "@googleapis/tasks": "^17.0.0",
     "@googleapis/webmasters": "^9.0.0",
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/node": "2.0.0",
+    "@modelcontextprotocol/server": "2.0.0",
     "googleapis-common": "^9.0.0",
     "jose": "^6.2.8",
     "markdown-it": "15.0.0",
@@ -115,7 +116,6 @@
   },
   "overrides": {
     "tmp": "^0.2.4",
-    "fast-uri": "^3.1.6",
     "hono": "^4.13.5",
     "qs": "^6.16.0"
   }