feat(power-automate): v3.0.1 — MCP SDK v2, stateless protocol, zod 4 + bug fixes

[Matt Townsend (radioblazer)]

Summary

Major SDK upgrade to support the 2026-07-28 stateless MCP specification.

What changed

Component	Before (v2.x)	After (v3.0.0)
MCP SDK	@modelcontextprotocol/sdk@1.30.0\	@modelcontextprotocol/server@2.0.0\
Zod	3.25.76	4.4.3 (\zod/v4\ native schemas)
Protocol	2025-11-25 only	2025-11-25 + 2026-07-28 (auto-detect)
Node.js	>=18	>=20 (breaking)

Stateless MCP benefits

• No session state: each request is self-contained, no \initialize\ handshake needed
• Load-balanceable: no sticky sessions, round-robin across instances
• 1.65x faster: 7.1ms vs 11.7ms per tool call (eliminates handshake round-trip)
• Backward compatible: \legacy: 'stateless'\ serves old 2025-11-25 clients transparently

What's preserved

All prior fixes are included in this bundle:

• PPAPI DNS fallback for Default environments ([power-automate][Bug] Default-env fix (#261) insufficient — default environments served by the classic regional Flow API have no PPAPI host, so list_flows still fails #269, [power-automate][Bug] FlowAgent: all flow operations fail with ENOTFOUND when the per-environment *.environment.api.powerplatform.com endpoint is not provisioned #271, [power-automate][Bug] FlowAgent PPAPI calls fail with "fetch failed" against tenant-default environments #274, [power-automate][Bug] FlowAgent tools fail to resolve environment ID for "Default"-type Power Platform environments #276, [power-automate][Bug] list_flows fails with ENOTFOUND for tenant "Default" environments lacking PPAPI provisioning #278, [power-automate][Bug] list_flows/smoke_test fail with malformed PPAPI hostname for tenant-level "Default" environments #281, [power-automate][Bug] All flow operations fail with ENOTFOUND in default environments that lack per-environment PPAPI DNS endpoints #282, [power-automate][Bug] Flow API calls fail with malformed hostname (ENOTFOUND) for Default environment #283)
• Button trigger body passthrough ([power-automate][Bug] flowagent: run_flow with body fails for Button/manual (Request) triggers — ListCallbackUrlOperationBlocked #280)
• Solution flow clientdata write path (fix(power-automate): v2.3.1 — editFlow, solution flow round-trip, resolvers, datasets (#314) #318)
• Large-flow update fix

Testing

• 56 tools registered, bundle starts cleanly
• 116 core tests pass
• Benchmark: 7.1ms mean (stateless) vs 11.7ms (legacy) over 100 iterations

Breaking change

Node.js >=20 required. The v2 MCP SDK requires Node 20+. Users on Node 18 must upgrade.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

plugins/power-automate/server/mcp.mjs:28826

• rewriteConnectionNamesForPpapi() has the same recursion gap as stripInjectedAuthentication(): it walks actions, else.actions, and cases.*.actions, but does not traverse default.actions for Switch. Any actions under the default branch will keep host.connectionName and can still fail PPAPI writes for solution flows.
  plugins/power-automate/server/mcp.mjs:28766
• stripInjectedAuthentication() claims to walk common nesting containers, but it currently only recurses into actions, else.actions, and cases.*.actions. Switch actions also commonly have a default.actions branch, which will be skipped, leaving injected inputs.authentication fields in nested default-branch actions and causing the same write failures this helper is meant to prevent.

This issue also appears on line 28822 of the same file.

[Matt Townsend (radioblazer)]

Updated 2026-08-11: rebased onto main + bug fixes

Branch force-pushed to resolve merge conflict and include 4 bug fixes for issues filed after this PR opened:

Issue	Fix
#395 / #396 / #400 / #401	Default env PPAPI hostname — \list_connections, \list_connectors, \search_operations, \get_operation_details\ all failed with ENOTFOUND for \Default-\ environments. The PPAPI subdomain must prepend literal \default\ to the GUID hex segment.
#362	\search_operations\ connector filter silently ignored — field name mismatch (\searchText/\operationGroupName\ in MCP handler vs \query/\connector\ in FlowClient).
#363	\get_operation_details\ returned empty parameters — PPAPI schema uses JSON Schema (\inputsDefinition.properties), not .parameters. Required flags now derived from parent \
equired[]\ array.
#360	\�uthentication\ not stripped before Dataverse write — Split into recursive auth stripping (both write paths) and \connectionName→connectionReferenceName\ rewriting (PPAPI-only). Fixes \WorkflowRunActionInputsInvalidProperty\ for nested solution-flow actions.

929 tests pass. PR is now rebased on main and \MERGEABLE.

[Matt Townsend (radioblazer)]

Updated to v3.0.1 (2026-08-11)

Branch force-pushed with corrected version, clean build, and live smoke test.

Changes from last update:

• Version bumped 3.0.0 → 3.0.1 (bug-fix release on top of SDK upgrade)
• \�undle:plugin\ now compiles only \packages/core+cli\ — fixes build failure caused by \packages/live\ TypeScript errors (old/new SDK McpServer type mismatch, zod v4 \z.record\ arity change), both masked by incremental build cache
• Bundle rebuilt from a *clean clone of \matow_microsoft/flow-agent* (not cached notebook build)
• CJS
  equire\ interop banner verified present
• All 5 bug fix markers confirmed in bundle

Smoke test: ✅ passed in 13.8s (env \839eace6\ / msdefault)

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

plugins/power-automate/.plugin/plugin.json:3

• The PR description/title describes a major MCP SDK + protocol upgrade with breaking Node.js version requirements, but the diff shown here only bumps the plugin version. If the substantive server/skill changes are intentionally out-of-scope, the PR description should be updated; otherwise, the PR appears incomplete (missing the actual implementation changes that justify a 3.x release).

  "version": "3.0.1",

[Matt Townsend (radioblazer)]

Addressed Copilot review (2026-08-11)

Hostname comment (line 27706): Keeping the \default\ prefix. DNS-verified:

• \default72f988bf86f141af91ab2d7cd011db.47.environment.api.powerplatform.com\ → resolves ✅
• \72f988bf86f141af91ab2d7cd011db.47.environment.api.powerplatform.com\ → NXDOMAIN ❌ (original behavior, the reported bug)

Switch \default.actions\ gap (suppressed comments): Fixed. Both \stripInjectedAuthentication\ and
ewriteConnectionNamesForPpapi\ now also walk \�ction.default.actions\ for Switch actions, alongside \cases\ and \�lse.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

plugins/power-automate/server/mcp.mjs:28638

• updateFlow() now calls rewriteConnectionNamesForPpapi(body) without ensuring body.properties.connectionReferences is present. rewriteConnectionNamesForPpapi() relies on connectionReferences to build the connectionName→connectionReferenceLogicalName map, but callers like editFlow() construct an update body with only properties.definition (no connectionReferences). If the Dataverse path is unavailable and the code falls through to PPAPI (which the catch explicitly supports), the rewrite becomes a no-op and can re-trigger the PPAPI validation failure this method is meant to prevent for solution flows.