docs: validate input-required elicitation examples

[sravan-v]

Updates the input-required examples to validate client-provided elicitation content at runtime and fail closed when confirmation or scope responses are invalid.

Fixes #2542.

Motivation and Context

ctx.mcpReq.inputResponses contains client-provided, untrusted data. Several examples used the generic acceptedContent<T>() overload, which provides compile-time typing but no runtime validation.

Some confirmation examples also checked only whether the response object existed instead of requiring confirm === true. The wipe-cache example defaulted a missing or malformed scope to all, which is unsafe for a destructive operation.

This change:

• passes Zod schemas to acceptedContent() for runtime validation
• requires confirmation to be exactly true
• re-requests missing or invalid scope while preserving confirmed request state
• removes the unsafe fallback to the all scope
• synchronizes the guide source, generated documentation, exported JSDoc, examples, conformance fixture, and relevant test fixtures

How Has This Been Tested?

The following checks passed locally:

• pnpm build:all — all 52 workspace packages built successfully
• pnpm sync:snippets --check
• type-checking for all affected packages
• linting and formatting checks for all affected packages
• core-internal test suite — 1,457 tests passed
• server test suite — 482 tests passed
• isolated MRTR end-to-end scenario — 24 tests passed
• runnable input-required guide example

The tested scenarios include:

• valid boolean confirmation is accepted
• confirmation must be exactly true
• elicitation responses are validated against their Zod schemas
• missing or invalid scope causes another scope request
• confirmed request state is preserved when scope must be requested again
• valid scope produces the expected cache-wipe response

A broad e2e invocation also executed unrelated stdio lifecycle scenarios. Six environment-sensitive stdio cases failed while 2,633 tests passed; the isolated MRTR scenario affected by this change passes.

Breaking Changes

No breaking changes.

This updates defensive example usage, generated documentation, and corresponding test fixtures. It does not change the acceptedContent() API.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing relevant tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

The same Zod schema instance is used both to describe the requested elicitation input and to validate the accepted response.

For the sequential wipe-cache example, an invalid scope response reissues only the scope request and mints { step: 'confirmed' } again. This avoids asking for confirmation again while ensuring an invalid scope can never silently become all.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 69df98e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2756

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2756

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2756

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2756

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2756

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2756

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2756

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2756

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2756

commit: 69df98e