fix(deps): update dependency @mastra/mcp to v1

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@mastra/mcp (source)	^0.11.0 → ^1.0.0

---

Release Notes

mastra-ai/mastra (@​mastra/mcp)

v1.14.0

Compare Source

Minor Changes

• Add serverlessStreaming option to MCPServer.startHTTP() for request-scoped progress notifications in serverless mode. (#​17927)

  Serverless mode (serverless: true) buffers each request into a single JSON response, which silently drops any notifications/progress a tool emits via extra.sendNotification(). Setting options: { serverless: true, serverlessStreaming: true } now handles the request with request-scoped SSE streaming (enableJsonResponse: false on the transient transport), so progress notifications reach the MCP client's onprogress handler before the final result. An explicit enableJsonResponse is also honored.

  await server.startHTTP({
    url,
    httpPath: '/mcp',
    req,
    res,
    options: { serverless: true, serverlessStreaming: true },
  });

  This is still fully stateless — no mcp-session-id is required or persisted — and the default behavior is unchanged (enableJsonResponse: true), so existing serverless JSON-response users are unaffected. It enables only notifications scoped to the current request, such as progress; elicitation, resource subscriptions, and out-of-request resource/list-change notifications still require session state.

• Fixed MCP server notifications (resource updates, resource/prompt list changes) not reaching clients connected over streamable HTTP. Notifications are now broadcast to every connected session across all transports. (#​19193)

  Fixed resource subscriptions being shared globally across all clients. Subscriptions are now tracked per session, so resources.notifyUpdated() only notifies sessions that subscribed to the resource URI, and one client unsubscribing no longer removes another client's subscription. Clients that relied on receiving notifications/resources/updated without subscribing must now call resources/subscribe first.

  Added support for the remaining MCP notification features:

  Dynamic tools and tools/list_changed

  Servers can now add and remove tools at runtime and notify clients via notifications/tools/list_changed:

  // Server: manage tools at runtime
  await server.toolActions.add({ myNewTool });
  await server.toolActions.remove(['myNewTool']);
  await server.toolActions.notifyListChanged();

  When the server is registered with a Mastra instance, dynamic add/remove also keeps the Mastra instance's tool registry in sync.

  // Client: react to tool list changes
  await mcp.tools.onListChanged('myServer', async () => {
    const tools = await mcp.listTools();
  });

  Server-side log messages

  Servers can now emit notifications/message log notifications. The minimum level a client sets via logging/setLevel is honored per session:

  // Broadcast to all connected clients
  await server.sendLoggingMessage({ level: 'info', data: { message: 'Sync completed' } });
  
  // From inside a tool, send to the calling client
  await context.mcp.log('debug', 'Fetching weather', { location });

  Progress notifications from tools

  Tools can now report progress to the calling client:

  await context.mcp.progress({ progress: 1, total: 3, message: 'step 1' });

Patch Changes

• Fixed MCP clients advertising elicitation support before a handler is registered. (#​19192)

• Fixed MCPServer dropping a resource's _meta from resources/read results. The read handler rebuilt each content item with only { uri, mimeType, text | blob }, so appResources (MCP Apps / SEP-1865) metadata attached during resources/list as _meta: { ui: meta } never reached the client. Hosts read the UI CSP from contents[]._meta.ui.csp, so connectDomains was silently ignored and widget fetch/XHR calls failed with Failed to fetch. The resource's _meta is now preserved on the read contents. (#​19163)

• Updated dependencies [bd6d240, 0111486, 96a3749, fe1bda0, 25e7c12, 1ce5121, fb8aea3, 4adc391, a5c6337, 3cfc47a, 2bb7817, 51d9870, 5cab274, 7fa27d3, 8b97958, 8410541, a58dcbb, aa38805, 153bd3b, 45a8e65, e955965, 2d22570, 07bb863, c8ed116, 01b338c, a99eae8, 860ef7e, 17e818c, edce8d2, 8a586ec, 4451dfe, 8b7361d, 1d39058, 3927473, dce50dc, fd13f8e, 634caff, f703f87, 3e26c87, 33f2b88, 177010f, 0ad646f, b486abf, 54a51e0, c43f3a9, a5008f2, e2d5f37, 4ce0163, 4378341]:

  • @​mastra/core@​1.51.0

v1.13.1

Compare Source

Patch Changes

• Fixed MCP client tools missing output schemas in tool listings. Fixes #​18850. (#​18854)

  MCP tools that declare an outputSchema now expose that schema on the Mastra tool wrapper, so Studio and other consumers can document expected tool outputs.

  Mastra does not re-validate MCP tool results. The MCP SDK still validates structuredContent via AJV. This keeps full CallToolResult envelopes and extra fields intact while making output shapes visible again.

  const tools = await mcp.listTools();
  const outputSchema = tools['weather_getForecast'].outputSchema?.['~standard'].jsonSchema.output({
    target: 'draft-07',
  });

• Updated dependencies [b291760, 3ffb8b7, 6ef59fe, 4039488, 29b7ea6, b2c9d70, a51c63d, 252f63d, 5ea76a7, 6445560, e2b9f33, 10959d5, c547a77, a0085fa, a2ba369, ffc3c17, 81542c1, 3908e53, cb24ce7, 02705fd, ae51e81, 6f304ef, 5f9858f]:

  • @​mastra/core@​1.50.0

v1.13.0

Compare Source

Minor Changes

• Fixed MCP tool execution failures being recorded as successes. (#​18482)

  A failing MCP tool used to look like it succeeded. The call was traced and saved as a success, and error handling like retries and Studio error states never ran. For tools with an outputSchema, the error message was thrown away, so neither the model nor the user saw why the call failed.

  This happened because the server reports the failure inside a normal result (with an isError flag), and MCPClient did not check that flag.

  Now isError: true results are surfaced on the failed-tool-call path: the tool throws with the server's error text, so spans, stream chunks, scorers, and persisted messages reflect the failure and the model can self-correct.

  You can opt back into the previous behavior per server with onToolError: 'return', which resolves with the raw result instead of throwing:

  const mcp = new MCPClient({
    servers: {
      weather: {
        url: new URL('https://example.com/mcp'),
        onToolError: 'return', // default is 'throw'
      },
    },
  });

Patch Changes

• Security hardening from CodeQL review: MCP serverless 500 responses no longer echo internal error messages to clients (details are still logged server-side), and macOS system notifications now escape backslashes and run osascript without a shell so notification text can't inject commands. (#​18805)

• Updated dependencies [700619b, 0f69865, 9250acd, 0c3d4bc, cc440a3, 6a61846, 215f9b0, 17369b2, c64c2a8, bcae929, ea6327b, 3439fa8, 85107f2, b33822e, 06e2680, 06ff9e0, d5c11e3, 7f5e1ff, ff80671, b8375c1, dab1257, 1240f05, 705ff39, e6fbd5b, 215f9b0, 24c10d3, 24c10d3, 24c10d3, 6f2026c, 24c10d3, 215f9b0, 215f9b0, 003f35d, f890eda, 1340fb7]:

  • @​mastra/core@​1.49.0

v1.12.1

Compare Source

Patch Changes

• Fixed @​mastra/mcp crashing Cloudflare Workers at module initialization. MCPClient can now be safely imported on workerd without the Worker failing to start. (#​18664)

• Updated dependencies [b9a2961, b33c77d, 1274eb3, cdd5f93, 1274eb3, 0ac14ce, 9566d27, 8be63b0, 1009f77, 1b8728a, 23c31de, 0368766, 6f578ac, 345eecc, 1917c53, c01012f, 705ba98, 95857bc, e62c108, 2866f04, ee14cae, e84e791, c2f0b7f, 213feb8, 58e287b, e420b3c, be875ed, 9eefdc0, bfbbb01, 7d112ca]:

  • @​mastra/core@​1.48.0

v1.12.0

Compare Source

Minor Changes

• Added MCPClient.listToolsWithErrors() to return namespaced tools alongside per-server discovery errors. (#​18030)

  Example:

  const { tools, errors } = await mcp.listToolsWithErrors();
  
  new Agent({
    name: 'assistant',
    tools,
  });
  
  if (Object.keys(errors).length > 0) {
    console.error(errors);
  }

Patch Changes

• Updated dependencies [5bd72d2, 1cc9ee1, 417baae, 65f255a, 74955f9, 30ebaf0, 5704634, 5c4e9a4, 4a88c6e, 417baae, 74955f9, 74955f9, 25961e3, 6a1428a, 87a17ef, e11ff30, 7794d71, 9d2c946, c0eda2b, 7b29f33, c0eda2b, b13925b, f1ec385, e14986f, 24912b1, bf94ec6, a29f371, 7686216, 74955f9, 073f910, 0be490f, 0be490f, ebbe1d3, 974f614, 3818814, 975c59a, 1f97ce5, 74955f9, 7f51548, 64f58c0, 74955f9, ebbe1d3, d95f394, 417baae, 8e25a78, 417baae, f3f0c9d, a5b22d3, 31be1cf, 417baae, 74955f9, 74955f9]:
  • @​mastra/core@​1.46.0

v1.11.0

Compare Source

Minor Changes

• Random bump (#​18178)

Patch Changes

• Updated dependencies [7c0d868, d9d2273, b04369d, 8f3c262]:
  • @​mastra/core@​1.45.0

v1.10.0

Compare Source

Minor Changes

• Added MCP server Fine-Grained Authorization mapping overrides for tool authorization. (#​17529)

  Use the new fga option on MCPServer to customize the resource and permission mappings used for tools/list and tools/call checks without changing the Mastra instance-level tool mapping used by internal agent and workflow tool execution.

  const server = new MCPServer({
    name: 'My Server',
    version: '1.0.0',
    tools: { getData },
    fga: {
      resourceMapping: {
        tool: {
          fgaResourceType: 'user',
          deriveId: ({ user }) => user.id,
        },
      },
      permissionMapping: {
        'tools:execute': 'read',
      },
    },
  });

Patch Changes

• Fixed MCPServer leaking one caller's resources to other callers. The result of the first resources/list request was cached on the shared, long-lived server instance and replayed to everyone, so a dynamic resource provider that scopes resources per user or tenant (resolved from extra.authInfo) served the first caller's resource index — names and URIs — to subsequent callers. The same stale cache also backed resources/read URI resolution and the public listResources() method. The resources/templates/list handler had the same defect for dynamic resource template providers. (#​17610)

  Resource and resource template providers are now invoked on every request with the current caller's context, so each caller only sees their own resources. See #​17609

• Fixed flaky MCP server tests by replacing real weather API calls with deterministic mock tool (#​17572)

• Updated dependencies [d468acb, 575f815, 34839c1, 053735a, 306909a, 5191af8, 43bd3d4, e6fa79e, 904bcdf, 7f5ee1d, 1e9aab5, 2bccba4, bf8eb6d, e9be4e7, 493a328, d53cfc2, 65799d4, c268c89, 34839c1, 014e00f, 029a414, d468acb, b147b29, d371ac1, 2bccba4, 0c72f03, cf182b7, 3b45ea9, a049c2a, f084be1, b147b29, 2a96528, f2ab060, 5d302c8, 34839c1, a952852, 2656d9c, 63e3fe1, 1d4ce8d, 8c68372]:

  • @​mastra/core@​1.42.0

v1.9.1

Compare Source

Patch Changes

• Removed Hono from @​mastra/core and auth package runtime dependencies. Auth providers now receive framework-agnostic request types that support standard Request objects and Hono-compatible request shapes. MCP and deployer avoid relying on core-bundled Hono context types at package boundaries. (#​17410)

• Updated dependencies [c973db4, 552285e, 77e686c, ece8dba, e751af2, e2a8380, be3f1cd, a34d9db]:

  • @​mastra/core@​1.39.0

v1.9.0

Compare Source

Minor Changes

• Added opt-in MCP server instructions forwarding into agent system prompts. (#​17155)

  When an MCP server advertises instructions during initialization, you can now forward that guidance into the system prompt of agents that use the server's tools. This is opt-in — set forwardInstructions: true per server to enable it. Forwarded instructions are injected into the agent's system prompt, so only enable this for servers you trust.

  const mcp = new MCPClient({
    servers: {
      db: {
        url: new URL('http://localhost:4111/mcp'),
        forwardInstructions: true, // opt in; defaults to false
        instructionsMaxLength: 512, // max chars forwarded per server
      },
    },
  });
  
  const agent = new Agent({
    id: 'db-agent',
    name: 'DB Agent',
    instructions: 'Help with database changes.',
    model,
    tools: await mcp.listTools(),
  });

  You can always inspect cached instructions without forwarding them:

  const instructions = mcp.getServerInstructions();
  // => { db: 'Always validate before migrating.', other: undefined }

• Added native multimodal tool-result support. Core now converts MCP-style tool results with image and audio content parts into model-native media output when building model prompts, without requiring MCP tools to persist duplicate media payloads in providerMetadata.mastra.modelOutput. (#​16866)

  return {
    content: [
      { type: 'text', text: 'Screenshot captured' },
      { type: 'image', data: base64Png, mimeType: 'image/png' },
    ],
  };

Patch Changes

• Support conditional, function-based tool approvals. (#​17337)

  • MCP tools that wrap a server-level requireToolApproval function are now honored end-to-end. The per-tool approval function was previously dropped when the agent converted MCP tools (it kept only the boolean flag), so conditional approval silently fell back to always-on. CoreToolBuilder now preserves a needsApprovalFn attached directly to a tool instance.
  • The global requireToolApproval option on agent.stream/agent.generate now accepts a function in addition to a boolean. It is evaluated per tool call with the tool name, arguments, and request context, enabling policies such as regex allowlists on tool names. Returning true requires approval for that call; false allows it. On error the call defaults to requiring approval. When a function policy is set, tool calls run sequentially so approval suspensions don't race. Durable agents and stored agents continue to accept only a boolean (a function degrades to requiring approval for every call, since their options must be serializable).

  // Approve only tool calls whose name is not on an allowlist.
  const allowlist = /^(get|list|search)_/;
  await agent.generate('...', {
    requireToolApproval: ({ toolName }) => !allowlist.test(toolName),
  });

  • Precedence is unchanged from before: a per-tool approval function (createTool({ requireApproval: fn }) or an MCP-derived needsApprovalFn) is authoritative for that tool and overrides the global setting, so a tool can still opt out of approval by returning false even when the global option is on. The only new behavior is that the global option may now be a function in addition to a boolean.
  • The previously implicit, runtime-attached per-tool approval predicate is now a typed contract: @mastra/core exports NeedsApprovalFn and declares the optional needsApprovalFn property on the Tool class. The MCP client and the agent runtime now share this typed contract instead of reaching through any. This is additive — no public API changes.

• Close the stale MCP transport before reconnecting so SSE connections no longer leak orphaned EventSource instances and accumulate server-side sessions on implicit reconnect. (#​17326)

• Fixed FGA-enabled MCP servers so OAuth authInfo can be mapped to a Mastra user before tools/list and tools/call authorization. (#​17475)

• Updated dependencies [fa63872, d779de3, 1750c97, 9283971, f07b646, d8838ae, 40f9297, 19a8658, 850af77, 0f0d1ba, a18775a, 1baf2d1, 8c31bcd, 0e32507, 95b14cd, 07c3de7, 0bf2d93, 7b0d34c, a659a77, aa36be2, 3332be9, 212c635, d8838ae, 9aa5a73, f73c789, 8bd16da, c8630f8, 94dfef6, 47f71dc, 50ceae2, a122f79, 8cdde58, 3a081c1, 49f8abc, 847ff1e, 0c1ed1d, 259d409, 9e16c68, cefca33, d00e8c5, 36fa7e2, 87e9774, 65a72e7, fe9eacd, 4c02027, 0f77241, 849efb9, 92ff509, 3fce5e7, a763592, db79c86, 6855012, 80c7737, 7fef31c, 7fef31c, 3f1cf47]:

  • @​mastra/core@​1.38.0

v1.8.1

Compare Source

Patch Changes

• Removed zod as a required peer dependency. Internal schemas now use plain JSON Schema objects instead of zod runtime. (#​16726)

• Updated dependencies [cfa2e3a, 0cbece9, 2f5f58a, 7dfe1bc, ac442a4, b7286f4, 6096445, d72dc4b, a481027, 1e5c067, 168fa09, df1947a, ee59b74, a97b1a0, 008baaf, 801baa0, 8116436, c35b962, c27c4b9, 08b3b59, b3c3b18, 4084113, 70cb714, 91cf0e0, 7f9da22]:

  • @​mastra/core@​1.37.0

v1.8.0

Compare Source

Minor Changes

• Added MCP tool annotations to the requireToolApproval context and exposed them on tools returned from listTools() / listToolsets(). (#​16784)

  The requireToolApproval callback now receives the server-advertised annotations (title, readOnlyHint, destructiveHint, idempotentHint, openWorldHint) alongside toolName and args. This lets you write declarative approval policies instead of hardcoding tool name lists. Annotations are also propagated onto Mastra tools as tool.mcp.annotations so apps can render them in UI.

  Security caveat (per the MCP spec): annotations are hints, not guarantees. Clients MUST treat them as untrusted unless they come from a trusted server. Do not use annotations alone as a security boundary for servers you do not control — set requireToolApproval: true for those. When the server omits annotations entirely, this field is undefined, so policies can distinguish "no annotations" from "annotated as safe".

  import { MCPClient } from '@​mastra/mcp';
  
  // Before — hardcoded tool name lists, server-specific
  const mcp = new MCPClient({
    servers: {
      github: {
        url: new URL('https://example.com/mcp'),
        requireToolApproval: ({ toolName }) => toolName === 'delete_repo',
      },
    },
  });
  
  // After — annotation-driven, works across any trusted MCP server
  const mcp = new MCPClient({
    servers: {
      github: {
        url: new URL('https://example.com/mcp'),
        requireToolApproval: ({ annotations }) => {
          if (!annotations) return true;
          if (annotations.readOnlyHint) return false;
          if (annotations.destructiveHint) return true;
          return false;
        },
      },
    },
  });
  
  // Annotations are also visible on tools returned by listTools()
  const tools = await mcp.listTools();
  for (const tool of Object.values(tools)) {
    console.log(tool.mcp?.annotations);
  }

  Closes #​16766.

Patch Changes

• Fixed an issue where OAuth token requests dropped client_id and client_secret for confidential clients. The provider previously shipped an empty addClientAuthentication method that satisfied the MCP SDK's existence check and short-circuited its default credential attachment, causing invalid_request errors on token exchange and refresh against confidential-client OAuth servers. The empty stub has been removed so the SDK's built-in client authentication runs again. See #​16854. (#​16862)

• Close previous SSE transport before accepting a new connection in MCPServer.connectSSE(). Previously, sequential SSE connections to the same server would fail with "Already connected to a transport" because the underlying protocol was never closed when the previous client disconnected. (#​16695)

• Updated dependencies [452036a, c272d50, 27fd1b7, 5ba7253, 5556cc1, f73980d, 5499303, a702009, 9aee493, [d8692af](https://redirect.github.com/mastra-ai

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.