fix(cloudflare): use Worker-safe validation for MCP

src/providers/cloudflare_mcp/executors.test.ts

@@ -1,6 +1,10 @@
-import { describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import { cloudflareMcpActionHandlers, credentialValidators } from "./executors.ts";
 
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
 describe("Cloudflare MCP executors", () => {
   it("sends bearer auth and maps search to the official MCP tool", async () => {
     const calls: Array<Record<string, unknown>> = [];
@@ -39,6 +43,16 @@ describe("Cloudflare MCP executors", () => {
     expect(oauthResult?.metadata?.mcpTools).toEqual(["docs", "execute", "search"]);
   });
 
+  it("validates MCP tool schemas when string code generation is unavailable", async () => {
+    vi.stubGlobal("Function", function disabledFunctionConstructor() {
+      throw new EvalError("Code generation from strings disallowed for this context");
+    });
+
+    await expect(
+      credentialValidators.apiKey!({ apiKey: "api-token", values: {} }, { fetcher: createMcpFetch([], "api-token") }),
+    ).resolves.toMatchObject({ metadata: { mcpTools: ["docs", "execute", "search"] } });
+  });
+
   it("does not start MCP traffic after the execution is cancelled", async () => {
     const controller = new AbortController();
     controller.abort();
@@ -78,6 +92,7 @@ function createMcpFetch(calls: Array<Record<string, unknown>>, expectedToken: st
               tools: ["docs", "execute", "search"].map((name) => ({
                 name,
                 inputSchema: { type: "object" },
+                outputSchema: { type: "object" },
               })),
             }
           : { content: [{ type: "text", text: '["workers"]' }] };

src/providers/cloudflare_mcp/executors.ts

@@ -5,13 +5,15 @@ import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport, StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { McpError } from "@modelcontextprotocol/sdk/types.js";
+import { CfWorkerJsonSchemaValidator } from "@modelcontextprotocol/sdk/validation/cfworker";
 import { createHash } from "node:crypto";
 import { defineBearerProviderExecutors, providerUserAgent, ProviderRequestError } from "../provider-runtime.ts";
 
 const service = "cloudflare_mcp";
 const cloudflareMcpEndpoint = "https://mcp.cloudflare.com/mcp";
 const cloudflareMcpRequestTimeoutMs = 60_000;
 const expectedTools = ["docs", "execute", "search"];
+const cloudflareMcpJsonSchemaValidator = new CfWorkerJsonSchemaValidator();
 
 type CloudflareMcpToolResult = Awaited<ReturnType<Client["callTool"]>>;
 
@@ -102,7 +104,10 @@ async function withCloudflareMcpClient<T>(
     fetch: input.fetcher,
     requestInit: { headers },
   });
-  const client = new Client({ name: "oomol-connect-cloudflare-mcp", version: "1.0.0" });
+  const client = new Client(
+    { name: "oomol-connect-cloudflare-mcp", version: "1.0.0" },
+    { jsonSchemaValidator: cloudflareMcpJsonSchemaValidator },
+  );
 
   try {
     await client.connect(transport, {