fix(core): only honor own-property brands in cross-bundle instanceof

A brand reachable through the prototype chain no longer satisfies the check,
so polluting a shared prototype with the registry symbol cannot make
arbitrary objects pass instanceof against the branded error classes. Real
instances are stamped with an own property and are unaffected.

Author: felixweinberger

packages/core-internal/src/errors/crossBundleBrand.ts

@@ -58,7 +58,12 @@ export function brandedHasInstance(cls: object, value: unknown): boolean {
         typeof value === 'object' &&
         value !== null &&
         Object.prototype.hasOwnProperty.call(cls, 'mcpBrand') &&
-        typeof (cls as BrandedConstructor).mcpBrand === 'string'
+        typeof (cls as BrandedConstructor).mcpBrand === 'string' &&
+        // Own-property only: a brand inherited via the prototype chain is never
+        // honored, so polluting Object.prototype with the registry symbol cannot
+        // make arbitrary objects satisfy instanceof (real instances are stamped
+        // with an own property by stampErrorBrands).
+        Object.prototype.hasOwnProperty.call(value, BRANDS)
     ) {
         const carried = (value as BrandCarrier)[BRANDS];
         if (carried && typeof carried.has === 'function' && carried.has((cls as BrandedConstructor).mcpBrand!)) {

packages/core-internal/test/errors/crossBundleBrand.test.ts

@@ -117,6 +117,21 @@ describe('cross-bundle error instanceof (branded)', () => {
         expect(json).not.toContain('mcp.Sdk');
     });
 
+    it('ignores a brand inherited via the prototype chain (prototype-pollution hardening)', () => {
+        const BRANDS = Symbol.for('mcp.sdk.errorBrands');
+        // A brand reachable only through the prototype chain must not count —
+        // otherwise polluting a shared prototype would make arbitrary objects
+        // satisfy instanceof against every branded class.
+        const polluted = Object.create({ [BRANDS]: new Set(['mcp.SdkError', 'mcp.SdkHttpError']) }) as object;
+        expect(polluted instanceof SdkError).toBe(false);
+        expect(polluted instanceof SdkHttpError).toBe(false);
+
+        // An own-property carrier (what stampErrorBrands produces) is honored.
+        const own = Object.create(Error.prototype) as object;
+        Object.defineProperty(own, BRANDS, { value: new Set(['mcp.SdkError']), enumerable: false });
+        expect(own instanceof SdkError).toBe(true);
+    });
+
     it('tolerates primitives, null, and brandless objects', () => {
         for (const value of [null, undefined, 42, 'x', Symbol('s'), {}, new Error('plain')]) {
             expect((value as unknown) instanceof SdkError).toBe(false);