[claude]

Requested by Felix Weinberger · Slack thread

Refs #3008.

A handler registered with setRequestHandler('tools/call', handler) receives the request parsed with the spec schema, so a member next to name and arguments does not reach it. The low-level server page now says so.

---

Generated by Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: af71cc5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@3087

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@3087

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@3087

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@3087

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@3087

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@3087

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@3087

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@3087

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@3087

commit: af71cc5

[claude]

I reviewed this docs-only PR and found no bugs; the new callout matches what the code does. Because .github/CODEOWNERS assigns every path to the typescript-sdk team, a code-owner look is still worthwhile.

What was reviewed:

• Traced the 2-arg setRequestHandler path in packages/core-internal/src/shared/protocol.ts: the handler receives the output of the era codec's validateRequest, not the raw request.
• Checked the tools/call params schema in both wire revisions (rev2025-11-25 and the rev2026-07-28 dispatch schema): both are plain z.object, so an undeclared sibling of name and arguments is stripped rather than rejected or passed through.
• Ruled out a conflict with params._meta: extension keys there do reach the handler, but _meta is a spec-defined member and the callout only speaks of members next to name and arguments.

Extended reasoning...

The change adds a four-line VitePress ::: info callout to docs/advanced/low-level-server.md and touches no code, tests or changesets, so it has no security-sensitive surface. The factual claim holds in the source: spec-method handlers get the schema-parsed request, and the tools/call params object is non-loose in both wire revisions, so unknown members are stripped. No findings were reported and there are no outstanding reviewer objections on the timeline. The only thing deciding defer over approve is that .github/CODEOWNERS has a catch-all rule making the changed path code-owned.