Skip to content

fix(server): use null-prototype maps for McpServer registries - #3021

Draft
Hugo-DDT wants to merge 1 commit into
modelcontextprotocol:mainfrom
Hugo-DDT:fix/mcp-registry-null-prototype
Draft

Hugo-DDT wants to merge 1 commit into
modelcontextprotocol:mainfrom
Hugo-DDT:fix/mcp-registry-null-prototype

Conversation

@Hugo-DDT

Copy link
Copy Markdown

Plain {} registries treat Object.prototype names (constructor, toString, proto, …) as already registered, so proxies that expose such upstream tools fail at registration. Initialize tool/prompt/resource registries with Object.create(null) and cover the names with red-green tests.

Fixes #3019

Motivation and Context

How Has This Been Tested?

Breaking Changes

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist

  • I have read the MCP Documentation
  • My code follows the repository's style guidelines
  • New and existing tests pass locally
  • I have added appropriate error handling
  • I have added or updated documentation as needed

Additional context

Plain `{}` registries treat Object.prototype names (constructor, toString,
__proto__, …) as already registered, so proxies that expose such upstream
tools fail at registration. Initialize tool/prompt/resource registries with
Object.create(null) and cover the names with red-green tests.

Fixes modelcontextprotocol#3019
@changeset-bot

changeset-bot Bot commented Oct 14, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: cd78c0f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages
Name Type
@modelcontextprotocol/server Patch
@modelcontextprotocol/client Patch
@modelcontextprotocol/codemod Patch
@modelcontextprotocol/core Patch
@modelcontextprotocol/server-legacy Patch
@modelcontextprotocol/core-internal Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new

pkg-pr-new Bot commented Oct 14, 2026 •

Copy link
Copy Markdown

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@3021

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@3021

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@3021

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@3021

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@3021

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@3021

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@3021

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@3021

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@3021

commit: cd78c0f

@Hugo-DDT

Copy link
Copy Markdown
Author

Closing draft so we can reopen as ready for review; Convert to ready is blocked for Hugo-DDT on this repo.

@Hugo-DDT Hugo-DDT closed this Oct 15, 2026
@Hugo-DDT Hugo-DDT reopened this Oct 15, 2026
@Hugo-DDT Hugo-DDT closed this Oct 15, 2026
@Hugo-DDT Hugo-DDT reopened this Oct 15, 2026
@claude claude Bot added the v2 Ideas, requests and plans for v2 of the SDK which will incorporate major changes and fixes label Oct 15, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

v2 Ideas, requests and plans for v2 of the SDK which will incorporate major changes and fixes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

McpServer.registerTool rejects tool names inherited from Object.prototype (constructor, toString, __proto__)

1 participant