zod v4: "additionalProperties: false" missing

[FelixBaum]

Summary

We upgraded zod from v3 to v4. After the upgrade, all input schemas are missing additionalProperties: false in the tools/list response.

With zod@v3 the additionalProperties: false is returned correctly in the inputSchema.

zod: v3 and v4
@modelcontextprotocol/sdk: v1 and v2

Reproduction

Use the following example with zod@v3 and zod@v4:

const server = new McpServer({ name: "test-server", version: "1.0.0" });
server.registerTool(
  "test",
  {
    description: "Breaking input schema",
    inputSchema: { testInput: z.string() },
    outputSchema: { testOutput: z.string() },
  },
  async () => ({ content: [], structuredContent: { testOutput: "abc" } })
);

With zod@v4 we have this generated input schema

inputSchema: {
  type: "object"
  properties: { ... } 1 item
  required: [ ... ] 1 item
  $schema: "https://json-schema.org/draft/2020-12/schema"
}

But with zod@v3 we have this generated input schema

inputSchema: {
  type: "object"
  properties: { ... } 1 item
  required: [ ... ] 1 item
  $schema: "https://json-schema.org/draft/2020-12/schema"
  additionalProperties: false
}

Is this expected behavior or a bug?

[uuzzrm]

Thanks for the clear reproduction. I can investigate a focused fix for the Zod 4 schema path, starting with a regression test around registerTool and the generated inputSchema, then keeping the implementation limited to restoring the expected additionalProperties: false behavior. Please assign the issue to @uuzzrm if this is still unclaimed; I will verify the relevant package tests before opening a PR.