feat: support latest Zod

README.md

@@ -58,7 +58,7 @@ Let's create a simple MCP server that exposes a calculator tool and some data. S
 import { McpServer, ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import express from 'express';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 
 // Create an MCP server
 const server = new McpServer({
@@ -477,7 +477,7 @@ MCP servers can request LLM completions from connected clients that support samp
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import express from 'express';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 
 const mcpServer = new McpServer({
     name: 'tools-with-sample-server',
@@ -561,7 +561,7 @@ For most use cases where session management isn't needed:
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import express from 'express';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 
 const app = express();
 app.use(express.json());
@@ -796,7 +796,7 @@ A simple server demonstrating resources, tools, and prompts:
 
 ```typescript
 import { McpServer, ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 
 const server = new McpServer({
     name: 'echo-server',
@@ -866,7 +866,7 @@ A more complex example showing database integration:
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import sqlite3 from 'sqlite3';
 import { promisify } from 'util';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 
 const server = new McpServer({
     name: 'sqlite-explorer',
@@ -961,7 +961,7 @@ If you want to offer an initial set of tools/prompts/resources, but later add ad
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import express from 'express';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 
 const server = new McpServer({
     name: 'Dynamic Example',

package.json

@@ -88,7 +88,7 @@
         "express-rate-limit": "^7.5.0",
         "pkce-challenge": "^5.0.0",
         "raw-body": "^3.0.0",
-        "zod": "^3.23.8",
+        "zod": "^3.25.76 || ^4.1.12",
         "zod-to-json-schema": "^3.24.1"
     },
     "peerDependencies": {

src/client/index.test.ts

@@ -2,7 +2,7 @@
 /* eslint-disable no-constant-binary-expression */
 /* eslint-disable @typescript-eslint/no-unused-expressions */
 import { Client } from './index.js';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import {
     RequestSchema,
     NotificationSchema,

src/client/index.ts

@@ -42,7 +42,7 @@ import {
 } from '../types.js';
 import { AjvJsonSchemaValidator } from '../validation/ajv-provider.js';
 import type { JsonSchemaType, JsonSchemaValidator, jsonSchemaValidator } from '../validation/types.js';
-import { ZodLiteral, ZodObject, z } from 'zod';
+import { ZodLiteral, ZodObject, z } from 'zod/v3';
 import type { RequestHandlerExtra } from '../shared/protocol.js';
 
 /**

src/examples/server/jsonResponseStreamableHttp.ts

@@ -2,7 +2,7 @@ import express, { Request, Response } from 'express';
 import { randomUUID } from 'node:crypto';
 import { McpServer } from '../../server/mcp.js';
 import { StreamableHTTPServerTransport } from '../../server/streamableHttp.js';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import { CallToolResult, isInitializeRequest } from '../../types.js';
 import cors from 'cors';
 

src/examples/server/mcpServerOutputSchema.ts

@@ -6,7 +6,7 @@
 
 import { McpServer } from '../../server/mcp.js';
 import { StdioServerTransport } from '../../server/stdio.js';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 
 const server = new McpServer({
     name: 'mcp-output-schema-high-level-example',

src/examples/server/simpleSseServer.ts

@@ -1,7 +1,7 @@
 import express, { Request, Response } from 'express';
 import { McpServer } from '../../server/mcp.js';
 import { SSEServerTransport } from '../../server/sse.js';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import { CallToolResult } from '../../types.js';
 
 /**

src/examples/server/simpleStatelessStreamableHttp.ts

@@ -1,7 +1,7 @@
 import express, { Request, Response } from 'express';
 import { McpServer } from '../../server/mcp.js';
 import { StreamableHTTPServerTransport } from '../../server/streamableHttp.js';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import { CallToolResult, GetPromptResult, ReadResourceResult } from '../../types.js';
 import cors from 'cors';
 

src/examples/server/simpleStreamableHttp.ts

@@ -1,6 +1,6 @@
 import express, { Request, Response } from 'express';
 import { randomUUID } from 'node:crypto';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import { McpServer } from '../../server/mcp.js';
 import { StreamableHTTPServerTransport } from '../../server/streamableHttp.js';
 import { getOAuthProtectedResourceMetadataUrl, mcpAuthMetadataRouter } from '../../server/auth/router.js';

src/examples/server/sseAndStreamableHttpCompatibleServer.ts

@@ -3,7 +3,7 @@ import { randomUUID } from 'node:crypto';
 import { McpServer } from '../../server/mcp.js';
 import { StreamableHTTPServerTransport } from '../../server/streamableHttp.js';
 import { SSEServerTransport } from '../../server/sse.js';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import { CallToolResult, isInitializeRequest } from '../../types.js';
 import { InMemoryEventStore } from '../shared/inMemoryEventStore.js';
 import cors from 'cors';

src/examples/server/toolWithSampleServer.ts

@@ -2,7 +2,7 @@
 
 import { McpServer } from '../../server/mcp.js';
 import { StdioServerTransport } from '../../server/stdio.js';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 
 const mcpServer = new McpServer({
     name: 'tools-with-sample-server',

src/integration-tests/stateManagementStreamableHttp.test.ts

@@ -12,7 +12,7 @@ import {
     ListPromptsResultSchema,
     LATEST_PROTOCOL_VERSION
 } from '../types.js';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 
 describe('Streamable HTTP Transport Session Management', () => {
     // Function to set up the server with optional session management

src/integration-tests/taskResumability.test.ts

@@ -6,7 +6,7 @@ import { StreamableHTTPClientTransport } from '../client/streamableHttp.js';
 import { McpServer } from '../server/mcp.js';
 import { StreamableHTTPServerTransport } from '../server/streamableHttp.js';
 import { CallToolResultSchema, LoggingMessageNotificationSchema } from '../types.js';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import { InMemoryEventStore } from '../examples/shared/inMemoryEventStore.js';
 
 describe('Transport resumability', () => {

src/server/auth/handlers/authorize.ts

@@ -1,5 +1,5 @@
 import { RequestHandler } from 'express';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import express from 'express';
 import { OAuthServerProvider } from '../provider.js';
 import { rateLimit, Options as RateLimitOptions } from 'express-rate-limit';

src/server/auth/handlers/token.ts

@@ -1,4 +1,4 @@
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import express, { RequestHandler } from 'express';
 import { OAuthServerProvider } from '../provider.js';
 import cors from 'cors';

src/server/auth/middleware/clientAuth.ts

@@ -1,4 +1,4 @@
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import { RequestHandler } from 'express';
 import { OAuthRegisteredClientsStore } from '../clients.js';
 import { OAuthClientInformationFull } from '../../../shared/auth.js';

src/server/completable.test.ts

@@ -1,4 +1,4 @@
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import { completable } from './completable.js';
 
 describe('completable', () => {

src/server/completable.ts

@@ -1,4 +1,4 @@
-import { ZodTypeAny, ZodTypeDef, ZodType, ParseInput, ParseReturnType, RawCreateParams, ZodErrorMap, ProcessedCreateParams } from 'zod';
+import { ZodTypeAny, ZodTypeDef, ZodType, ParseInput, ParseReturnType, RawCreateParams, ZodErrorMap, ProcessedCreateParams } from 'zod/v3';
 
 export enum McpZodTypeKind {
     Completable = 'McpCompletable'

src/server/index.test.ts

@@ -1,5 +1,5 @@
 /* eslint-disable @typescript-eslint/no-unused-vars */
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import { Client } from '../client/index.js';
 import { InMemoryTransport } from '../inMemory.js';
 import type { Transport } from '../shared/transport.js';

src/server/mcp.test.ts

@@ -1,4 +1,4 @@
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import { Client } from '../client/index.js';
 import { InMemoryTransport } from '../inMemory.js';
 import { getDisplayName } from '../shared/metadataUtils.js';

src/server/mcp.ts

@@ -1,6 +1,6 @@
 import { Server, ServerOptions } from './index.js';
 import { zodToJsonSchema } from 'zod-to-json-schema';
-import { z, ZodRawShape, ZodObject, ZodString, ZodTypeAny, ZodType, ZodTypeDef, ZodOptional } from 'zod';
+import { z, ZodRawShape, ZodObject, ZodString, ZodTypeAny, ZodType, ZodTypeDef, ZodOptional } from 'zod/v3';
 import {
     Implementation,
     Tool,

src/server/sse.test.ts

@@ -4,7 +4,7 @@ import { SSEServerTransport } from './sse.js';
 import { McpServer } from './mcp.js';
 import { createServer, type Server } from 'node:http';
 import { AddressInfo } from 'node:net';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import { CallToolResult, JSONRPCMessage } from '../types.js';
 
 const createMockResponse = () => {

src/server/streamableHttp.test.ts

@@ -4,7 +4,7 @@ import { randomUUID } from 'node:crypto';
 import { EventStore, StreamableHTTPServerTransport, EventId, StreamId } from './streamableHttp.js';
 import { McpServer } from './mcp.js';
 import { CallToolResult, JSONRPCMessage } from '../types.js';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import { AuthInfo } from './auth/types.js';
 
 async function getFreePort() {

src/server/title.test.ts

@@ -1,7 +1,7 @@
 import { Server } from './index.js';
 import { Client } from '../client/index.js';
 import { InMemoryTransport } from '../inMemory.js';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import { McpServer, ResourceTemplate } from './mcp.js';
 
 describe('Title field backwards compatibility', () => {

src/shared/auth.ts

@@ -1,4 +1,4 @@
-import { z } from 'zod';
+import { z } from 'zod/v3';
 
 /**
  * Reusable URL validation that disallows javascript: scheme

src/shared/protocol-transport-handling.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, test, beforeEach } from '@jest/globals';
 import { Protocol } from './protocol.js';
 import { Transport } from './transport.js';
 import { Request, Notification, Result, JSONRPCMessage } from '../types.js';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 
 // Mock Transport class
 class MockTransport implements Transport {

src/shared/protocol.test.ts

@@ -1,4 +1,4 @@
-import { ZodType, z } from 'zod';
+import { ZodType, z } from 'zod/v3';
 import { ClientCapabilities, ErrorCode, McpError, Notification, Request, Result, ServerCapabilities } from '../types.js';
 import { Protocol, mergeCapabilities } from './protocol.js';
 import { Transport } from './transport.js';

src/shared/protocol.ts

@@ -1,4 +1,4 @@
-import { ZodLiteral, ZodObject, ZodType, z } from 'zod';
+import { ZodLiteral, ZodObject, ZodType, z } from 'zod/v3';
 import {
     CancelledNotificationSchema,
     ClientCapabilities,

src/types.ts

@@ -1,4 +1,4 @@
-import { z, ZodTypeAny } from 'zod';
+import { z, ZodTypeAny } from 'zod/v3';
 import { AuthInfo } from './server/auth/types.js';
 
 export const LATEST_PROTOCOL_VERSION = '2025-06-18';