fix(server): use null-prototype maps for McpServer registries

[Hugo-DDT]

Plain {} registries treat Object.prototype names (constructor, toString, proto, …) as already registered, so proxies that expose such upstream tools fail at registration. Initialize tool/prompt/resource registries with Object.create(null) and cover the names with red-green tests.

Fixes #3019

Motivation and Context

How Has This Been Tested?

Breaking Changes

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[changeset-bot]

🦋 Changeset detected

Latest commit: af73cca

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/server	Patch
@modelcontextprotocol/client	Patch
@modelcontextprotocol/codemod	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/core-internal	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@3021

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@3021

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@3021

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@3021

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@3021

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@3021

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@3021

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@3021

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@3021

commit: af73cca

[Hugo-DDT]

Closing draft so we can reopen as ready for review; Convert to ready is blocked for Hugo-DDT on this repo.

[VishwamDhavale]

I reproduced issue #3019 locally and noticed a related edge case in the tools/call handler. Calling an unregistered tool named toString appears to return Tool toString disabled because the registry lookup resolves an inherited Object.prototype property.

PR #3021 covers registering and calling prototype-named tools, but doesn't appear to test whether calling an unregistered prototype-named tool correctly returns Tool toString not found.

Would an additional regression test for this case be useful in your PR?

[Hugo-DDT]

Good catch, thanks @VishwamDhavale! Added a regression test that calling an unregistered toString returns not found.

[VishwamDhavale]

Good catch, thanks @VishwamDhavale! Added a regression test that calling an unregistered toString returns not found.

Thanks for adding the test! Glad the edge case was useful. Appreciate it! 🙌

[Hugo-DDT]

Closing this draft to reopen as a ready-for-review PR (open-PR limit blocked converting to ready).

[Hugo-DDT]

Closing so a ready (non-draft) PR can be opened from the same branch via the compare page.