fix(conformance): advertise raw 2020-12 schema in json-schema-2020-12 fixture tool

The json-schema-2020-12 server scenario asserts that $schema, $defs/$anchor,
additionalProperties, composition (allOf/anyOf), and conditional (if/then/else)
keywords are preserved verbatim in tools/list. The fixture registered the tool
with a zod schema that never contained those keywords, so the scenario failed
with 'field was likely stripped'. Register the exact scenario schema as raw
JSON Schema via fromJsonSchema() instead; all 7 checks now pass.

Also note the per-tool outputSchema compile-failure scoping in the SEP-2106
changeset.

Author: mattzcarey

.changeset/sep-2106-json-schema-2020-12.md

@@ -13,5 +13,9 @@ Implement SEP-2106: tool `inputSchema`/`outputSchema` conform to JSON Schema 202
 - `McpServer.registerTool` type-checks a handler's returned `structuredContent` against the tool's `outputSchema` inferred output.
 - Servers returning array or primitive `structuredContent` automatically also emit a serialized `TextContent` block, so pre-SEP clients can fall back to the text content.
 - Built-in validators refuse to dereference non-same-document `$ref`/`$dynamicRef` (SSRF guard) and reject schemas exceeding depth / subschema-count bounds (composition-DoS guard).
-- The default Node validator now uses `Ajv2020`, so the 2020-12 dialect is honored by default (previously `new Ajv()` ran draft-07 semantics and silently ignored keywords such as `prefixItems`). Both built-in validators now default to the `2020-12` dialect (`MCP_DEFAULT_SCHEMA_DIALECT`).
-- New opt-in `resolveExternalSchemaRefs(schema, options)` helper (the SEP's optional external-`$ref` mode): fetches and inlines non-local `$ref`s ahead of time into a self-contained schema. Disabled by default, enforces a host allowlist (and rejects loopback/link-local/private targets otherwise), `https`-only by default, with fetch timeout / response-size / document-count limits, dereference logging, and fail-closed on unresolved references.
+- `Client.listTools()` no longer rejects when a single advertised tool's `outputSchema` fails to compile (e.g. it trips the safety guards above): the failure is scoped to the offending tool. Every other tool stays listable and callable; calling the offending tool throws a
+  descriptive error instead of silently skipping output validation.
+- The default Node validator now uses `Ajv2020`, so the 2020-12 dialect is honored by default (previously `new Ajv()` ran draft-07 semantics and silently ignored keywords such as `prefixItems`). Both built-in validators now default to the `2020-12` dialect
+  (`MCP_DEFAULT_SCHEMA_DIALECT`).
+- New opt-in `resolveExternalSchemaRefs(schema, options)` helper (the SEP's optional external-`$ref` mode): fetches and inlines non-local `$ref`s ahead of time into a self-contained schema. Disabled by default, enforces a host allowlist (and rejects loopback/link-local/private
+  targets otherwise), `https`-only by default, with fetch timeout / response-size / document-count limits, dereference logging, and fail-closed on unresolved references.

test/conformance/src/everythingServer.ts

@@ -12,7 +12,7 @@ import { randomUUID } from 'node:crypto';
 import { localhostHostValidation } from '@modelcontextprotocol/express';
 import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
 import type { CallToolResult, EventId, EventStore, GetPromptResult, ReadResourceResult, StreamId } from '@modelcontextprotocol/server';
-import { isInitializeRequest, McpServer, ResourceTemplate } from '@modelcontextprotocol/server';
+import { fromJsonSchema, isInitializeRequest, McpServer, ResourceTemplate } from '@modelcontextprotocol/server';
 import cors from 'cors';
 import type { Request, Response } from 'express';
 import express from 'express';
@@ -597,19 +597,43 @@ function createMcpServer() {
         }
     );
 
-    // SEP-1613: JSON Schema 2020-12 conformance test tool
+    // SEP-1613 / SEP-2106: JSON Schema 2020-12 conformance test tool. The `json-schema-2020-12`
+    // scenario asserts that `$schema`, `$defs`/`$anchor`, `additionalProperties`, composition
+    // (`allOf`/`anyOf`), and conditional (`if`/`then`/`else`) keywords are preserved verbatim in
+    // the tools/list response, so the schema is registered as raw JSON Schema via fromJsonSchema().
     mcpServer.registerTool(
         'json_schema_2020_12_tool',
         {
-            description: 'Tool with JSON Schema 2020-12 features for conformance testing (SEP-1613)',
-            inputSchema: z.object({
-                name: z.string().optional(),
-                address: z
-                    .object({
-                        street: z.string().optional(),
-                        city: z.string().optional()
-                    })
-                    .optional()
+            description: 'Tool with JSON Schema 2020-12 features for conformance testing (SEP-1613, SEP-2106)',
+            inputSchema: fromJsonSchema<{ name?: string; address?: { street?: string; city?: string } }>({
+                $schema: 'https://json-schema.org/draft/2020-12/schema',
+                type: 'object',
+                $defs: {
+                    address: {
+                        $anchor: 'addressDef',
+                        type: 'object',
+                        properties: {
+                            street: { type: 'string' },
+                            city: { type: 'string' }
+                        }
+                    }
+                },
+                properties: {
+                    name: { type: 'string' },
+                    address: { $ref: '#/$defs/address' },
+                    contactMethod: { type: 'string', enum: ['phone', 'email'] },
+                    phone: { type: 'string' },
+                    email: { type: 'string' }
+                },
+                allOf: [{ anyOf: [{ required: ['phone'] }, { required: ['email'] }] }],
+                if: {
+                    properties: { contactMethod: { const: 'phone' } },
+                    required: ['contactMethod']
+                },
+                // eslint-disable-next-line unicorn/no-thenable -- JSON Schema conditional keyword, not a Promise
+                then: { required: ['phone'] },
+                else: { required: ['email'] },
+                additionalProperties: false
             })
         },
         async (args: { name?: string; address?: { street?: string; city?: string } }): Promise<CallToolResult> => {