Skip to content

Elicitation feature fails on Cloudflare Workers due to AJV code generation (EvalError: Code generation from strings disallowed) #689

Open
@kentcdodds

Description

@kentcdodds

Describe the bug
When using the elicitInput (elicitation) feature in a Cloudflare Workers environment, schema validation fails with an EvalError: Code generation from strings disallowed. This is due to AJV v6 using new Function for dynamic code generation, which is not permitted in edge environments like Cloudflare Workers.

To Reproduce
Steps to reproduce the behavior:

  1. Use the @modelcontextprotocol/sdk in a Cloudflare Workers environment.
  2. Call the elicitInput method (for example, as part of the elicitation feature).
  3. Observe that schema validation fails with an EvalError after submitting a response to the elicitation request.

Expected behavior
Schema validation should work in edge environments like Cloudflare Workers, which do not allow dynamic code generation (e.g., new Function). The SDK should use a compatible JSON Schema validator or provide a way to inject one.

Logs

EvalError: Code generation from strings disallowed for this context
    at new Function (<anonymous>)
    at Ajv3.localCompile (.../index.js:3411:30)
    at Ajv3.resolve (.../index.js:2571:73)
    at Object.resolveRef (.../index.js:3475:26)
    at Object.generate_ref [as code] (.../index.js:3808:26)
    at Object.generate_validate [as validate] (.../index.js:3128:40)
    at Object.generate_properties [as code] (.../index.js:5825:30)
    at generate_validate (.../index.js:3220:39)
    at localCompile (.../index.js:3384:26)
    at Ajv3.compile (.../index.js:3356:17)

Suggestions

  • Consider replacing AJV v6 with a JSON Schema validator that is compatible with edge environments, such as @cfworker/json-schema.
  • Alternatively, upgrade to AJV v8 and use its interpreted mode (code: { source: false }), which does not rely on dynamic code generation.
  • Provide a configuration option or hook in the SDK to allow users to supply their own schema validator, making the SDK more flexible for different environments.
  • Document any current limitations or workarounds for using the SDK in edge environments like Cloudflare Workers.

Additional context

  • This is a blocker for using the elicitation feature on Cloudflare Workers and other edge environments.
  • The relevant code in the SDK appears here: src/server/index.ts#L328
  • My use case is using the elicitation feature for user input in a journaling app deployed on Cloudflare Workers.
  • AJV v6 is not compatible with edge environments due to its reliance on dynamic code generation. Consider using a validator like @cfworker/json-schema or upgrading to AJV v8 with interpreted mode.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions