Update MCP SDK to v1.23.0 with native zod v3/v4 compatibility

[Copilot]

MCP SDK v1.23.0 (released Nov 25, 2025) includes native zod v3/v4 compatibility via typescript-sdk#1040, allowing us to remove the restrictive version pinning workaround from #248 and #250.

Changes

• Dependencies

  • Updated @modelcontextprotocol/sdk from ^1.8.0 to ^1.23.0
  • Changed zod-to-json-schema from ~3.24.5 to ^3.24.5 (workaround no longer needed)

• SDK API adaptation

  • Removed elicitation from server capabilities (it's a client capability)
  • Fixed readonlyHint → readOnlyHint (correct casing per SDK spec)
  • Migrated from deprecated server.tool() to server.registerTool() API
  • Added type assertion to work around TypeScript deep type instantiation issues with SDK's Zod generics

// Before (deprecated)
server.tool(name, description, paramsSchema, annotations, (args) => cb(args));

// After
(server.registerTool as any)(name, { description, inputSchema: paramsSchema, annotations }, (args) => cb(args));

The as any assertion is required because the SDK's complex Zod type inference causes TypeScript heap exhaustion during compilation. Runtime behavior is correct.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com//advisories
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Use latest MCP sdk to fix zod-to-json-schema workaround</issue_title>
<issue_description>With #248 and #250 we have added a workaround for some issues with zod and zod-to-json-schema.

In the meantime, MCP sdk has working on a fix aswell: modelcontextprotocol/typescript-sdk#1040

Once this fix has been released, we should incorporate it, and hopefully revert the workaround.</issue_description>

<agent_instructions>Can you check whether there is already a new version out that fixes the mentioned problem?</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@christian-kreuzberger-dtx Hi @armchairdeity , have you had these issues with v0.13.1 of our mcp server? @christian-kreuzberger-dtx @ryanfk I have tried this multiple times now, locally as well as on GitHub Codespaces, and I never ran into this issue. My guess is that there is some cached dependency in some `node_modules` folder. But I can't really help with troubleshooting.

• Fixes Use latest MCP sdk to fix zod-to-json-schema workaround #251

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[github-actions]

📦 Package.json Changes Detected

This PR modifies package.json. Please review the following changes carefully, and tick the following checklist boxes:

Checklist for Reviewers

• Verify that new and/or updated dependencies are necessary and from trusted sources
• Review any script changes for (security) implications
• Verify whether a new version should be released after merging the PR

Package.json Diff

diff --git a/package.json b/package.json
index bf1e1f0..059a74d 100644
--- a/package.json
+++ b/package.json
@@ -54,11 +54,11 @@
     "@dynatrace-sdk/client-query": "^1.18.1",
     "@dynatrace-sdk/shared-errors": "^1.0.0",
     "@dynatrace/openkit-js": "^4.1.0",
-    "@modelcontextprotocol/sdk": "^1.8.0",
+    "@modelcontextprotocol/sdk": "^1.23.0",
     "commander": "^14.0.0",
     "dt-app": "^1.3.1",
     "open": "^8.4.2",
-    "zod-to-json-schema": "~3.24.5"
+    "zod-to-json-schema": "^3.24.5"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",

---

This comment was automatically generated by the PR Package.json Comment workflow.

[github-actions]

📦 Package.json Changes Detected

This PR modifies package.json. Please review the following changes carefully, and tick the following checklist boxes:

Checklist for Reviewers

• Verify that new and/or updated dependencies are necessary and from trusted sources
• Review any script changes for (security) implications
• Verify whether a new version should be released after merging the PR

Package.json Diff

diff --git a/package.json b/package.json
index bf1e1f0..059a74d 100644
--- a/package.json
+++ b/package.json
@@ -54,11 +54,11 @@
     "@dynatrace-sdk/client-query": "^1.18.1",
     "@dynatrace-sdk/shared-errors": "^1.0.0",
     "@dynatrace/openkit-js": "^4.1.0",
-    "@modelcontextprotocol/sdk": "^1.8.0",
+    "@modelcontextprotocol/sdk": "^1.23.0",
     "commander": "^14.0.0",
     "dt-app": "^1.3.1",
     "open": "^8.4.2",
-    "zod-to-json-schema": "~3.24.5"
+    "zod-to-json-schema": "^3.24.5"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",

---

This comment was automatically generated by the PR Package.json Comment workflow.

[MrManny]

Snyk flags dt-app@1.3.1 and suggests an upgrade to 1.3.2.
@christian-kreuzberger-dtx should we do that?

[Copilot]

Pull request overview

This PR updates the MCP SDK from v1.8.0 to v1.23.0, which includes native support for both Zod v3 and v4. This enables the removal of the restrictive zod-to-json-schema version pinning workaround that was previously needed. The update also requires migrating from deprecated APIs to the new SDK interfaces.

Key Changes

• Dependency updates: Updated @modelcontextprotocol/sdk to v1.23.0 and relaxed zod-to-json-schema constraint from ~3.24.5 to ^3.24.5
• API migration: Migrated from deprecated server.tool() to server.registerTool() with type assertions to work around TypeScript deep type instantiation issues
• SDK compliance fixes: Corrected readonlyHint to readOnlyHint property casing and removed elicitation from server capabilities (it's a client capability)

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
package.json	Updated MCP SDK to v1.23.0 and relaxed zod-to-json-schema version constraint
package-lock.json	Lock file updates reflecting new SDK version and its dependencies (ajv v8, zod v4 bundled in SDK)
src/index.ts	Migrated to new registerTool API, fixed property casing, removed unused import, and removed elicitation from server capabilities
CHANGELOG.md	Added entry documenting the MCP SDK update

[Copilot]

The changelog entry should provide more detail about the specific changes made. According to the project's changelog style guidelines, entries should include technical details relevant to users. Consider expanding this entry to mention:

• The MCP SDK API migration from deprecated server.tool() to server.registerTool()
• The fix for readonlyHint → readOnlyHint property casing
• Removal of elicitation from server capabilities

Example format:

- Updated MCP SDK to v1.23.0 which includes native zod v3/v4 compatibility
- Changed zod-to-json-schema version constraint from ~3.24.5 to ^3.24.5 (workaround no longer needed)
- Migrated from deprecated server.tool() API to server.registerTool() API
- Fixed readonlyHint property casing to readOnlyHint to match SDK specification
- Removed elicitation from server capabilities (it is a client capability)