Skip to content

chore(deps): update @ai-sdk/mcp to v2 - #411

Draft
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ai-sdk-mcp-2.x
Draft

chore(deps): update @ai-sdk/mcp to v2#411
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ai-sdk-mcp-2.x

Conversation

@renovate

@renovate renovate Bot commented Jun 29, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@ai-sdk/mcp (source) ^1.0.25^2.0.0 age confidence

Release Notes

vercel/ai (@​ai-sdk/mcp)

v2.0.31

Patch Changes

v2.0.30

Compare Source

Patch Changes

v2.0.29

Compare Source

Patch Changes

v2.0.28

Compare Source

Patch Changes

v2.0.27

Compare Source

Patch Changes

v2.0.26

Compare Source

Patch Changes

v2.0.25

Compare Source

Patch Changes

v2.0.24

Compare Source

Patch Changes

v2.0.23

Compare Source

Patch Changes

v2.0.22

Compare Source

Patch Changes

v2.0.21

Compare Source

Patch Changes

v2.0.20

Compare Source

Patch Changes

v2.0.19

Compare Source

Patch Changes

v2.0.18

Compare Source

Patch Changes

v2.0.17

Compare Source

Patch Changes

v2.0.16

Compare Source

Patch Changes

v2.0.15

Compare Source

Patch Changes

v2.0.14

Compare Source

Patch Changes
  • 48e7e78: Harden MCP Apps handling of server-supplied resource metadata and the host/iframe bridge:

    • Runtime-validate _meta.ui and drop malformed or non-string fields.
    • Gate iframe permissions deny-by-default via a new sandbox.allowedPermissions allowlist.
    • Derive a concrete postMessage target origin and validate inbound message origins.
    • Validate inbound bridge params: limit resources/read to ui:// resources and allow only https/http/mailto in ui/open-link.
    • Add fingerprintMCPAppResource / detectMCPAppResourceDrift for pinning and comparing app resources.

v2.0.13

Patch Changes

v2.0.12

Patch Changes

v2.0.10

Compare Source

Patch Changes

v2.0.9

Compare Source

Patch Changes

v2.0.8

Compare Source

Patch Changes
  • 3e6e955: Reject in-flight MCP requests when their abort signal fires and remove the pending response handler.
  • eebd14b: Prevent streamable HTTP MCP background SSE disconnects from surfacing as unhandled promise rejections.

v2.0.7

Compare Source

Patch Changes

v2.0.6

Compare Source

Patch Changes

v2.0.5

Compare Source

Patch Changes

v2.0.4

Compare Source

Patch Changes

v2.0.3

Compare Source

Patch Changes

v2.0.2

Compare Source

Patch Changes
  • ba6d510: chore: fix deprecated use of zod .passthrough()

v2.0.1

Compare Source

Patch Changes
  • 241a8c5: Add Streamable HTTP session hooks, cached initialize metadata, and detach-on-close support for reattaching to MCP sessions.

v2.0.0

Compare Source

Major Changes
  • 23fa161: fix(mcp): setting redirect: error for MCP transport
  • ef992f8: Remove CommonJS exports from all packages. All packages are now ESM-only ("type": "module"). Consumers using require() must switch to ESM import syntax.
  • 8359612: Start v7 pre-release
Patch Changes
  • b79094c: Add resource_link content type to CallToolResultSchema and PromptMessageSchema per MCP spec. Fixes hard rejection when MCP servers return resource_link content parts with zod ≥ 4.4.x.

  • 78e0023: fix(mcp): await addClientAuthentication in token exchange and refresh

  • b567a6c: dependency updates

  • e33ad0b: fix(mcp): add optional hook to validate authorization servers

  • e3ea484: fix(mcp): bypass outputSchema validation when tool returns isError

  • 93afb28: feat(mcp): expose server instructions to be accessible through client

  • a00d1d3: feat(mcp): allow custom fetch for HTTP and SSE transports

  • a98bf66: feat(mcp): surface 'serverInfo' exposed from the MCP server

  • 2a150f8: fix(mcp): lock first sse endpoint received via event

  • 2655da8: fix(mcp): use negotiated protocol version in transport request headers

  • 9f0e36c: trigger release for all packages after provenance setup

  • f7bc0b4: feat(mcp): expose statusCode, url, and responseBody on MCPClientError for HTTP transport failures

    MCPClientError now carries structured HTTP context when it originates from the
    streamable HTTP transport. This lets downstream consumers (e.g. agent frameworks
    that need to decide whether to fall back from streamable HTTP to legacy SSE
    transport per the MCP spec) branch on the actual response status without parsing
    the error message string.

    Fields are optional — they remain undefined for stdio transport errors and for
    non-response failures (network errors, aborts).

  • dcefad3: fix(mcp): respond to ping requests with an empty result per JSON-RPC spec (closes #​6282)

  • b44b051: fix(mcp): prevent prototype-named tools from bypassing the schemas allowlist

    When using client.tools({ schemas }) to expose only an explicitly allowed
    subset of an MCP server's tools, the allowlist check used the in operator,
    which also matches inherited Object.prototype properties. A server-advertised
    tool named constructor, toString, __proto__, etc. would pass the check
    even though the developer never defined it in schemas, and was then exposed to
    the model and executable. The check now uses Object.hasOwn, so only
    explicitly defined tools are returned.

  • f634bac: feat(mcp): add new McpProviderMetadata type

  • b9b3899: changeset for #​13384

  • 1e89d62: fix(mcp): strip trailing slash from OAuth resource parameter

  • 3e0b82f: fix(mcp): support official sdk protocol version negotiation

  • 1451759: feat(mcp): deprecate name and use clientName for MCPClient

  • 7fc6bd6: Raise minimum supported Node.js version to 22. Supported versions: 22, 24, and 26.

  • 08d2129: feat(mcp): propagate the server name through dynamic tool parts

  • 58c9eb1: feat(mcp): add redirect option to MCPTransportConfig for controlling HTTP redirect behavior

  • 0c4c275: trigger initial canary release

  • 611f621: feat(mcp): feat(mcp): add support for MCP Apps

  • 9ecd8ae: fix(mcp): add MCP protocol version 2025-11-25 to supported versions

  • 6c17a9f: fix(mcp): deduplicate auth refresh on http transport

  • 69254e0: feat(ai): add toolMetadata for tool specific metdata

  • 258c093: chore: ensure consistent import handling and avoid import duplicates or cycles

  • f0c6770: fix(mcp): prevent mcp oauth credential exfiltration during rediscovery

  • 5463d0d: feat(provider): align tool result output content file part types with top-level message file part types

  • b8396f0: trigger initial beta release

  • b29e087: fix (mcp): handle SSE messages without explicit event fields

  • 90e2d8a: chore: fix unused vars not being flagged by our lint tooling

  • 024a6b4: fix(mcp): validate oauth metadata issuer during discovery

  • 9b0bc8a: fix(mcp): prevent prototype pollution by using secureJsonParse

  • ff5eba1: feat: roll image-* tool output types into their equivalent file-* types

v1.0.71

Compare Source

Patch Changes

v1.0.70

Compare Source

Patch Changes

v1.0.69

Compare Source

Patch Changes

v1.0.68

Compare Source

Patch Changes

v1.0.67

Compare Source

Patch Changes

v1.0.66

Compare Source

Patch Changes
  • e8d2654: Honor MCP request deadlines and support bounding or aborting client initialization.

v1.0.65

Compare Source

Patch Changes

v1.0.64

Compare Source

Patch Changes
  • a3bc948: fix(mcp): accept OAuth metadata without code challenge methods

v1.0.63

Compare Source

Patch Changes

v1.0.62

Compare Source

Patch Changes

v1.0.61

Compare Source

Patch Changes

v1.0.60

Compare Source

Patch Changes
  • 937d731: Reject in-flight MCP requests when their abort signal fires and remove the pending response handler.
  • 2b6c67f: Prevent streamable HTTP MCP background SSE disconnects from surfacing as unhandled promise rejections.
  • Updated dependencies [d559de9]

v1.0.59

Compare Source

Patch Changes

v1.0.58

Compare Source

Patch Changes
  • f12f0d3: feat(mcp): expose a json-rpc message validator

v1.0.57

Compare Source

Patch Changes

v1.0.56

Compare Source

Patch Changes

v1.0.55

Compare Source

Patch Changes

v1.0.54

Compare Source

Patch Changes

v1.0.53

Compare Source

Patch Changes

v1.0.52

Compare Source

Patch Changes

v1.0.51

Patch Changes
  • aa39fc8: fix (mcp): handle SSE messages without explicit event fields

v1.0.49

Patch Changes
  • 3e8d9ba: fix(mcp): lock first sse endpoint received via event

  • 4fa7354: fix(mcp): prevent prototype-named tools from bypassing the schemas allowlist

    When using client.tools({ schemas }) to expose only an explicitly allowed
    subset of an MCP server's tools, the allowlist check used the in operator,
    which also matches inherited Object.prototype properties. A server-advertised
    tool named constructor, toString, __proto__, etc. would pass the check
    even though the developer never defined it in schemas, and was then exposed to
    the model and executable. The check now uses Object.hasOwn, so only
    explicitly defined tools are returned.

  • Updated dependencies [bfa5864]

  • Updated dependencies [f42aa79]

v1.0.47

Compare Source

Patch Changes
  • bf1d6bd: fix(mcp): prevent mcp oauth credential exfiltration during rediscovery

v1.0.46

Compare Source

Patch Changes
  • 1f817db: fix(mcp): await addClientAuthentication in token exchange and refresh

v1.0.45

Compare Source

Patch Changes
  • ec5fceb: fix(mcp): respond to ping requests with an empty result per JSON-RPC spec (closes #​6282)

v1.0.44

Compare Source

Patch Changes
  • 77775a4: feat(mcp): expose statusCode, url, and responseBody on MCPClientError for HTTP transport failures

    MCPClientError now carries structured HTTP context when it originates from the
    streamable HTTP transport. This lets downstream consumers (e.g. agent frameworks
    that need to decide whether to fall back from streamable HTTP to legacy SSE
    transport per the MCP spec) branch on the actual response status without parsing
    the error message string.

    Fields are optional — they remain undefined for stdio transport errors and for
    non-response failures (network errors, aborts).

v1.0.43

Compare Source

Patch Changes
  • e2b923f: fix(mcp): deduplicate auth refresh on http transport

v1.0.42

Compare Source

Patch Changes
  • 725f2ed: feat(mcp): expose server instructions to be accessible through client
  • 7281592: fix(mcp): use negotiated protocol version in transport request headers

v1.0.41

Compare Source

Patch Changes

v1.0.40

Compare Source

Patch Changes
  • 221a984: Add resource_link content type to CallToolResultSchema and PromptMessageSchema per MCP spec. Fixes hard rejection when MCP servers return resource_link content parts with zod ≥ 4.4.x.
  • 0084974: feat(mcp): deprecate name and use clientName for MCPClient

v1.0.39

Compare Source

Patch Changes

v1.0.38

Compare Source

Patch Changes

v1.0.37

Compare Source

Patch Changes

v1.0.36

Compare Source

Patch Changes
  • 9a8d276: feat(mcp): surface 'serverInfo' exposed from the MCP server

v1.0.35

Compare Source

Patch Changes
  • 941ebf2: fix(mcp): bypass outputSchema validation when tool returns isError

v1.0.34

Compare Source

Patch Changes
  • 1141b93: feat(mcp): allow custom fetch for HTTP and SSE transports

v1.0.33

Compare Source

Patch Changes

v1.0.32

Compare Source

Patch Changes
  • 47c6af0: fix(mcp): strip trailing slash from OAuth resource parameter

v1.0.31

Compare Source

Patch Changes

v1.0.30

Compare Source

Patch Changes

v1.0.29

Compare Source

Patch Changes
  • cc8b506: feat(mcp): add redirect option to MCPTransportConfig for controlling HTTP redirect behavior

v1.0.28

Compare Source

Patch Changes
  • 0c86a13: fix(mcp): validate state param in oauth flow

v1.0.27

Compare Source

Patch Changes
  • 1920b22: fix(mcp): add MCP protocol version 2025-11-25 to supported versions

v1.0.26

Compare Source

Patch Changes

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • "before 9am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@coderabbitai

coderabbitai Bot commented Jun 29, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 700f91d5-780b-4473-adb8-d6142df4d32e

📥 Commits

Reviewing files that changed from the base of the PR and between c009d77 and ee6baa5.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (1)
  • packages/runtime-core/package.json
🚧 Files skipped from review as they are similar to previous changes (1)
  • packages/runtime-core/package.json

📝 Walkthrough

Walkthrough

@ai-sdk/mcp in packages/runtime-core/package.json was updated from ^1.0.25 to ^2.0.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Mergeability Score: ⚪ Minimal · up to ee6ba

This dependency update introduces no supported merge-blocking risk at the current head and is merge-ready after normal checks and review.

🚥 Pre-merge checks | ✅ 6
✅ Passed checks (6 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Updates Docs ✅ Passed The direct PR diff changes only the @ai-sdk/mcp manifest entry and pnpm lockfile; it implements no feature that requires documentation updates.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the dependency update from @ai-sdk/mcp 1.x to 2.x.

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Jun 29, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.30%. Comparing base (d20bc24) to head (c5662cd).

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #411   +/-   ##
=======================================
  Coverage   88.30%   88.30%           
=======================================
  Files         191      191           
  Lines       10697    10697           
  Branches     3079     3079           
=======================================
  Hits         9446     9446           
  Misses       1249     1249           
  Partials        2        2           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coderabbitai[bot]
coderabbitai Bot previously approved these changes Jun 29, 2026
@renovate
renovate Bot force-pushed the renovate/ai-sdk-mcp-2.x branch from 9439d07 to 69d302e Compare June 29, 2026 13:19
@renovate
renovate Bot force-pushed the renovate/ai-sdk-mcp-2.x branch from 69d302e to 1d894b8 Compare July 1, 2026 22:51
coderabbitai[bot]
coderabbitai Bot previously approved these changes Jul 1, 2026
coderabbitai[bot]
coderabbitai Bot previously approved these changes Jul 2, 2026
coderabbitai[bot]
coderabbitai Bot previously approved these changes Jul 9, 2026
@renovate
renovate Bot force-pushed the renovate/ai-sdk-mcp-2.x branch from 5f19fe2 to 80a36b2 Compare July 9, 2026 13:38
@renovate
renovate Bot force-pushed the renovate/ai-sdk-mcp-2.x branch from 80a36b2 to 4443532 Compare July 9, 2026 18:59
coderabbitai[bot]
coderabbitai Bot previously approved these changes Jul 9, 2026
@renovate
renovate Bot force-pushed the renovate/ai-sdk-mcp-2.x branch from 4443532 to 8ba7fa9 Compare July 13, 2026 11:40
@renovate
renovate Bot force-pushed the renovate/ai-sdk-mcp-2.x branch from 8ba7fa9 to 40b9734 Compare July 14, 2026 22:39
coderabbitai[bot]
coderabbitai Bot previously approved these changes Jul 14, 2026
coderabbitai[bot]
coderabbitai Bot previously approved these changes Jul 15, 2026
coderabbitai[bot]
coderabbitai Bot previously approved these changes Aug 5, 2026
@renovate
renovate Bot force-pushed the renovate/ai-sdk-mcp-2.x branch from c35cd84 to bb390b5 Compare August 5, 2026 17:32
@coderabbitai

coderabbitai Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

@coderabbitai

coderabbitai Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

coderabbitai[bot]
coderabbitai Bot previously approved these changes Aug 6, 2026
@renovate
renovate Bot force-pushed the renovate/ai-sdk-mcp-2.x branch from 2635a17 to c009d77 Compare August 7, 2026 08:04
@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

@renovate
renovate Bot force-pushed the renovate/ai-sdk-mcp-2.x branch 2 times, most recently from d80e1ab to 71701ee Compare August 7, 2026 08:42
@renovate
renovate Bot force-pushed the renovate/ai-sdk-mcp-2.x branch from 71701ee to 53ef050 Compare August 8, 2026 21:38
coderabbitai[bot]
coderabbitai Bot previously approved these changes Aug 8, 2026
coderabbitai[bot]
coderabbitai Bot previously approved these changes Aug 11, 2026
@renovate
renovate Bot force-pushed the renovate/ai-sdk-mcp-2.x branch from eb998c9 to b43c5c7 Compare August 11, 2026 15:21
@renovate
renovate Bot force-pushed the renovate/ai-sdk-mcp-2.x branch from b43c5c7 to d4c2fab Compare August 12, 2026 04:46
coderabbitai[bot]
coderabbitai Bot previously approved these changes Aug 12, 2026
@renovate
renovate Bot force-pushed the renovate/ai-sdk-mcp-2.x branch 5 times, most recently from ee6baa5 to 5551b9e Compare August 13, 2026 12:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants