fix: compute schema conversions before mutating state in update()

Prevents inconsistent state if standardSchemaToJsonSchema() or
promptArgumentsFromStandardSchema() throws during tool/prompt update.
Previously the registered object's schema field was mutated before the
conversion call, leaving stale cached values on failure.

Author: ravyg

packages/server/src/server/mcp.ts

@@ -737,9 +737,10 @@ export class McpServer {
                 // Track if we need to regenerate the handler
                 let needsHandlerRegen = false;
                 if (updates.argsSchema !== undefined) {
+                    // Compute before mutating so state stays consistent if conversion throws.
+                    const newCachedArguments = promptArgumentsFromStandardSchema(updates.argsSchema);
                     registeredPrompt.argsSchema = updates.argsSchema;
-                    // Re-cache prompt arguments alongside the schema update.
-                    registeredPrompt.cachedArguments = promptArgumentsFromStandardSchema(updates.argsSchema);
+                    registeredPrompt.cachedArguments = newCachedArguments;
                     currentArgsSchema = updates.argsSchema;
                     needsHandlerRegen = true;
                 }
@@ -827,10 +828,10 @@ export class McpServer {
                 // Track if we need to regenerate the executor
                 let needsExecutorRegen = false;
                 if (updates.paramsSchema !== undefined) {
+                    // Compute before mutating so state stays consistent if conversion throws.
+                    const newInputJsonSchema = standardSchemaToJsonSchema(updates.paramsSchema, 'input') as Tool['inputSchema'];
                     registeredTool.inputSchema = updates.paramsSchema;
-                    // Re-cache the JSON Schema; surfaces conversion errors
-                    // synchronously like the initial registration does.
-                    registeredTool.inputJsonSchema = standardSchemaToJsonSchema(updates.paramsSchema, 'input') as Tool['inputSchema'];
+                    registeredTool.inputJsonSchema = newInputJsonSchema;
                     needsExecutorRegen = true;
                 }
                 if (updates.callback !== undefined) {
@@ -843,8 +844,10 @@ export class McpServer {
                 }
 
                 if (updates.outputSchema !== undefined) {
+                    // Compute before mutating so state stays consistent if conversion throws.
+                    const newOutputJsonSchema = standardSchemaToJsonSchema(updates.outputSchema, 'output') as Tool['outputSchema'];
                     registeredTool.outputSchema = updates.outputSchema;
-                    registeredTool.outputJsonSchema = standardSchemaToJsonSchema(updates.outputSchema, 'output') as Tool['outputSchema'];
+                    registeredTool.outputJsonSchema = newOutputJsonSchema;
                 }
                 if (updates.annotations !== undefined) registeredTool.annotations = updates.annotations;
                 if (updates._meta !== undefined) registeredTool._meta = updates._meta;

test/integration/test/server/mcp.test.ts

@@ -2356,6 +2356,64 @@ describe('Zod v4', () => {
                 }
             });
         });
+
+        /***
+         * Test: tool.update() leaves state consistent when schema conversion throws (#1847)
+         *
+         * If the new schema is invalid (e.g. non-object type), the conversion
+         * throws. State must remain unchanged — no partial mutation.
+         */
+        test('should not mutate tool state when paramsSchema conversion throws', async () => {
+            const mcpServer = new McpServer({
+                name: 'test server',
+                version: '1.0'
+            });
+
+            const originalCb = async () => ({
+                content: [{ type: 'text' as const, text: 'original' }]
+            });
+
+            const tool = mcpServer.registerTool('consistent', { inputSchema: z.object({ name: z.string() }) }, originalCb);
+
+            const originalInputSchema = tool.inputSchema;
+            const originalInputJsonSchema = tool.inputJsonSchema;
+
+            // z.string() is not an object schema, so conversion will throw.
+            expect(() => {
+                tool.update({
+                    paramsSchema: z.string() as never,
+                    callback: async () => ({ content: [{ type: 'text' as const, text: 'new' }] })
+                });
+            }).toThrow();
+
+            // State must be unchanged.
+            expect(tool.inputSchema).toBe(originalInputSchema);
+            expect(tool.inputJsonSchema).toBe(originalInputJsonSchema);
+        });
+
+        test('should not mutate tool state when outputSchema conversion throws', async () => {
+            const mcpServer = new McpServer({
+                name: 'test server',
+                version: '1.0'
+            });
+
+            const tool = mcpServer.registerTool('consistent-output', { outputSchema: z.object({ result: z.number() }) }, async () => ({
+                content: [{ type: 'text' as const, text: '' }],
+                structuredContent: { result: 1 }
+            }));
+
+            const originalOutputSchema = tool.outputSchema;
+            const originalOutputJsonSchema = tool.outputJsonSchema;
+
+            expect(() => {
+                tool.update({
+                    outputSchema: z.string() as never
+                });
+            }).toThrow();
+
+            expect(tool.outputSchema).toBe(originalOutputSchema);
+            expect(tool.outputJsonSchema).toBe(originalOutputJsonSchema);
+        });
     });
 
     describe('resource()', () => {
@@ -4564,6 +4622,40 @@ describe('Zod v4', () => {
                 { name: 'extra', description: undefined, required: false }
             ]);
         });
+
+        /***
+         * Test: prompt.update() leaves state consistent when schema conversion throws (#1847)
+         */
+        test('should not mutate prompt state when argsSchema conversion throws', async () => {
+            const mcpServer = new McpServer({
+                name: 'test server',
+                version: '1.0'
+            });
+
+            const prompt = mcpServer.registerPrompt(
+                'consistent-prompt',
+                {
+                    argsSchema: z.object({ name: z.string() })
+                },
+                async () => ({
+                    messages: [{ role: 'user' as const, content: { type: 'text' as const, text: '' } }]
+                })
+            );
+
+            const originalArgsSchema = prompt.argsSchema;
+            const originalCachedArguments = prompt.cachedArguments;
+
+            // z.string() is not an object schema, so conversion will throw.
+            expect(() => {
+                prompt.update({
+                    argsSchema: z.string() as never
+                });
+            }).toThrow();
+
+            // State must be unchanged.
+            expect(prompt.argsSchema).toBe(originalArgsSchema);
+            expect(prompt.cachedArguments).toBe(originalCachedArguments);
+        });
     });
 
     describe('Tool title precedence', () => {