Method setRequestHandler

src/server/index.ts:218–294

* Override request handler registration to enforce server-side validation for tools/call.

(
        requestSchema: T,
        handler: (
            request: SchemaOutput<T>,
            extra: RequestHandlerExtra<ServerRequest | RequestT, ServerNotification | NotificationT>
        ) => ServerResult | ResultT | Promise<ServerResult | ResultT>
    )

     * Override request handler registration to enforce server-side validation for tools/call.
     */
    public override setRequestHandler<T extends AnyObjectSchema>(
        requestSchema: T,
        handler: (
            request: SchemaOutput<T>,
            extra: RequestHandlerExtra<ServerRequest | RequestT, ServerNotification | NotificationT>
        ) => ServerResult | ResultT | Promise<ServerResult | ResultT>
    ): void {
        const shape = getObjectShape(requestSchema);
        const methodSchema = shape?.method;
        if (!methodSchema) {
            throw new Error('Schema is missing a method literal');
        }

        // Extract literal value using type-safe property access
        let methodValue: unknown;
        if (isZ4Schema(methodSchema)) {
            const v4Schema = methodSchema as unknown as ZodV4Internal;
            const v4Def = v4Schema._zod?.def;
            methodValue = v4Def?.value ?? v4Schema.value;
        } else {
            const v3Schema = methodSchema as unknown as ZodV3Internal;
            const legacyDef = v3Schema._def;
            methodValue = legacyDef?.value ?? v3Schema.value;
        }

        if (typeof methodValue !== 'string') {
            throw new Error('Schema method literal must be a string');
        }
        const method = methodValue;

        if (method === 'tools/call') {
            const wrappedHandler = async (
                request: SchemaOutput<T>,
                extra: RequestHandlerExtra<ServerRequest | RequestT, ServerNotification | NotificationT>
            ): Promise<ServerResult | ResultT> => {
                const validatedRequest = safeParse(CallToolRequestSchema, request);
                if (!validatedRequest.success) {
                    const errorMessage =
                        validatedRequest.error instanceof Error ? validatedRequest.error.message : String(validatedRequest.error);
                    throw new McpError(ErrorCode.InvalidParams, `Invalid tools/call request: ${errorMessage}`);
                }

                const { params } = validatedRequest.data;

                const result = await Promise.resolve(handler(request, extra));

                // When task creation is requested, validate and return CreateTaskResult
                if (params.task) {
                    const taskValidationResult = safeParse(CreateTaskResultSchema, result);
                    if (!taskValidationResult.success) {
                        const errorMessage =
                            taskValidationResult.error instanceof Error
                                ? taskValidationResult.error.message
                                : String(taskValidationResult.error);
                        throw new McpError(ErrorCode.InvalidParams, `Invalid task creation result: ${errorMessage}`);
                    }
                    return taskValidationResult.data;
                }