fix(server): reject unsupported elicitation schema keywords

Author: mattzcarey

packages/server/src/server/server.ts

@@ -86,6 +86,28 @@ export type ServerOptions = ProtocolOptions & {
     jsonSchemaValidator?: jsonSchemaValidator;
 };
 
+function isJsonObject(value: unknown): value is Record<string, unknown> {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function findStrippedJsonSchemaPaths(original: unknown, parsed: unknown, path = ''): string[] {
+    if (Array.isArray(original) && Array.isArray(parsed)) {
+        return original.flatMap((item, index) => findStrippedJsonSchemaPaths(item, parsed[index], `${path}[${index}]`));
+    }
+
+    if (!isJsonObject(original) || !isJsonObject(parsed)) {
+        return [];
+    }
+
+    return Object.entries(original).flatMap(([key, value]) => {
+        const childPath = path ? `${path}.${key}` : key;
+        if (!Object.prototype.hasOwnProperty.call(parsed, key)) {
+            return [childPath];
+        }
+        return findStrippedJsonSchemaPaths(value, parsed[key], childPath);
+    });
+}
+
 /**
  * An MCP server on top of a pluggable transport.
  *
@@ -625,6 +647,13 @@ export class Server extends Protocol<ServerContext> {
                     `Elicitation requestedSchema only supports flat primitive properties (string, number, integer, boolean, and string enums): ${parsedParams.error.message}`
                 );
             }
+            const strippedSchemaPaths = findStrippedJsonSchemaPaths(normalizedParams.requestedSchema, parsedParams.data.requestedSchema);
+            if (strippedSchemaPaths.length > 0) {
+                throw new ProtocolError(
+                    ProtocolErrorCode.InvalidParams,
+                    `Elicitation requestedSchema contains unsupported JSON Schema keyword(s) after Standard Schema conversion: ${strippedSchemaPaths.join(', ')}`
+                );
+            }
             return { params: parsedParams.data, standardSchema };
         }
 

packages/server/test/server/jsonSchemaValidatorOverride.test.ts

@@ -220,6 +220,36 @@ describe('server JSON Schema validator overrides', () => {
         ).rejects.toThrow(/format/);
         expect(sawElicitationRequest).toBe(false);
 
+        await expect(
+            server.elicitInput({
+                message: 'What is your code?',
+                requestedSchema: z.object({
+                    code: z.string().regex(/^[A-Z]{3}$/)
+                })
+            })
+        ).rejects.toThrow(/properties\.code\.pattern/);
+        expect(sawElicitationRequest).toBe(false);
+
+        await expect(
+            server.elicitInput({
+                message: 'How many?',
+                requestedSchema: z.object({
+                    count: z.number().multipleOf(2)
+                })
+            })
+        ).rejects.toThrow(/properties\.count\.multipleOf/);
+        expect(sawElicitationRequest).toBe(false);
+
+        await expect(
+            server.elicitInput({
+                message: 'How many?',
+                requestedSchema: z.object({
+                    count: z.number().gt(0)
+                })
+            })
+        ).rejects.toThrow(/properties\.count\.exclusiveMinimum/);
+        expect(sawElicitationRequest).toBe(false);
+
         await server.close();
         await clientTransport.close();
     });