build(deps): bump @mastra/mcp from 1.15.0 to 1.16.0

[dependabot]

Bumps @mastra/mcp from 1.15.0 to 1.16.0.

Release notes

Sourced from @​mastra/mcp's releases.

Mar 25, 2026

Highlights

Smarter Model Selection for Observational Memory

@mastra/memory now lets you route observer and reflector calls to different models based on input size using ModelByInputTokens. Short inputs can go to a fast, cheap model while longer ones get sent to a more capable one -- all configured declaratively with token thresholds. Tracing shows which model was selected and why.

MongoDB Support for Datasets and Experiments

@mastra/mongodb now stores versioned datasets with full item history and time-travel queries, plus experiment results and CRUD. If you're already using MongoDBStore, this works automatically with no extra setup.

Okta Auth and RBAC

New @mastra/auth-okta package brings SSO authentication and role-based access control via Okta. Map Okta groups to Mastra permissions, verify JWTs against Okta's JWKS endpoint, and manage sessions -- or pair Okta RBAC with a different auth provider like Auth0 or Clerk.

Breaking Changes

• None called out in this changelog.

Changelog

@​mastra/core@1.16.0

Minor Changes

• Added dataset-agent association and experiment status tracking for the Evaluate workflow. (#14470)

  • Dataset targeting: Added targetType and targetIds fields to datasets, enabling association with agents, scorers, or workflows. Datasets can now be linked to multiple entities.
  • Experiment status: Added status field to experiment results ('needs-review', 'reviewed', 'complete') for review queue workflow.
  • Dataset experiment routes: Added API endpoints for triggering experiments from a dataset with configurable target type and target ID.
  • LLM data generation: Added endpoint for generating dataset items using an LLM with configurable count and prompt.
  • Failure analysis: Added endpoint for clustering experiment failures and proposing tags using LLM analysis.

• Added agent version support for experiments. When triggering an experiment, you can now pass an agentVersion parameter to pin which agent version to use. The agent version is stored with the experiment and returned in experiment responses. (#14562)

  const client = new MastraClient();
  await client.triggerDatasetExperiment({
  datasetId: "my-dataset",
  targetType: "agent",
  targetId: "my-agent",
  version: 3, // pin to dataset version 3
  agentVersion: "ver_abc123" // pin to a specific agent version
  });

• Added tool suspension handling to the Harness. (#14611)

  When a tool calls suspend() during execution, the harness now emits a tool_suspended event, reports agent_end with reason 'suspended', and exposes respondToToolSuspension() to resume execution with user-provided data.

... (truncated)

Changelog

Sourced from @​mastra/mcp's changelog.

1.16.0

Minor Changes

• Updated the MCP client and server to run on the MCP 2.0 packages. Request context, authentication, logging, and progress behavior are unchanged, so tools that read context.mcp.extra.authInfo, send progress, or use elicitation keep working as before. (#18683)

  Tool schemas advertised over MCP no longer declare a draft-07 $schema dialect. The MCP 2.0 default validator rejects that dialect, which previously made tools with output schemas fail on the client.

  If you pass a custom schema validator

  The optional jsonSchemaValidator option now takes its validator from the MCP packages. Update the import path:

  // Before
  import { CfWorkerJsonSchemaValidator } from '@modelcontextprotocol/sdk/validation/cfworker';
  // After
  import { CfWorkerJsonSchemaValidator } from '@​modelcontextprotocol/client/validators/cf-worker';
  const mcp = new MCPClient({
  servers: {
  weather: { url: new URL('https://example.com/mcp'), jsonSchemaValidator: new CfWorkerJsonSchemaValidator() },
  },
  });

  If you import MCP protocol types directly

  Types re-exported by @mastra/mcp (such as ToolAnnotations, LoggingLevel, and the OAuth helpers) are unchanged and need no edits. Only imports that reached past @mastra/mcp into @modelcontextprotocol/sdk need repointing to @modelcontextprotocol/client or @modelcontextprotocol/server.

• Add opt-in security hardening options to the MCP client. Both options are opt-in; default behavior is unchanged. (#20868)

  • allowedHosts on HTTP server configs restricts which hosts the client's HTTP requests may target, covering the initial connection, the SSE fallback, and OAuth discovery. On the default fetch path redirect hops are blocked before they are sent; with a custom fetch, the final response URL is validated after the request runs, so custom fetch implementations must enforce redirect policy themselves when preventing outbound contact is required.
  • inheritDefaultEnv: false on stdio server configs stops the subprocess from inheriting the SDK's default environment variables; only the entries you list in env are passed.

  const mcp = new MCPClient({
    servers: {
      weather: {
        url: new URL('https://weather.example/mcp'),
        allowedHosts: ['weather.example'],
      },
      local: {
        command: 'npx',
        args: ['tsx', 'stdio-server.ts'],
        inheritDefaultEnv: false,
        env: { WEATHER_API_KEY: process.env.WEATHER_API_KEY! },
      },
    },
  });

... (truncated)

Commits

• 387c6b7 chore: version - exit prerelease mode
• 361c421 chore: version packages
• 1b1dd7b Cache MCP tool definitions and rebuild tools without reconnecting at startup ...
• ac0a3b8 chore: version packages (alpha) (#20769)
• 9ba1247 fix(mcp): send MCP content text to the model via toModelOutput (#20176)
• 289f4ce fix(core,mcp): coerce sub-agent maxSteps and prevent spurious MCP reconnects ...
• 8e23a0b chore: version packages
• e7a5da4 feat: MCP v2 (draft) (#18683)
• c71e307 feat(mcp): opt-in allowedHosts URL policy and inheritDefaultEnv stdio isolati...
• 03348e6 chore(deps): update security updates [security] (major) (#19265)
• Additional commits viewable in compare view

[github-actions]

Coverage Report for server

Status	Category	Percentage	Covered / Total
🟢	Lines	98.38% (🎯 97%)	3173 / 3225
🟢	Statements	97.7% (🎯 96%)	3322 / 3400
🟢	Functions	98.74% (🎯 97%)	551 / 558
🟢	Branches	89.1% (🎯 87%)	1300 / 1459

File Coverage

No changed files found.

Generated in workflow #1978 for commit d565b62 by the Vitest Coverage Report Action

[github-actions]

Coverage Report for web

Status	Category	Percentage	Covered / Total
🟢	Lines	97.32% (🎯 96%)	1526 / 1568
🟢	Statements	96.24% (🎯 95%)	1613 / 1676
🟢	Functions	95.82% (🎯 95%)	643 / 671
🟢	Branches	90.77% (🎯 88%)	1013 / 1116

File Coverage

No changed files found.

Generated in workflow #1978 for commit d565b62 by the Vitest Coverage Report Action

[github-actions]

Coverage Report for shared

Status	Category	Percentage	Covered / Total
🟢	Lines	99.12% (🎯 98%)	226 / 228
🟢	Statements	81.2% (🎯 80%)	242 / 298
🟢	Functions	100% (🎯 98%)	76 / 76
🟢	Branches	63.52% (🎯 62%)	101 / 159

File Coverage

No changed files found.

Generated in workflow #1978 for commit d565b62 by the Vitest Coverage Report Action

[github-actions]

Coverage Report for widget

Status	Category	Percentage	Covered / Total
🟢	Lines	99.56% (🎯 98%)	229 / 230
🟢	Statements	99.19% (🎯 96%)	246 / 248
🟢	Functions	100% (🎯 98%)	45 / 45
🟢	Branches	95.96% (🎯 92%)	119 / 124

File Coverage

No changed files found.

Generated in workflow #1978 for commit d565b62 by the Vitest Coverage Report Action

[owk-owk130]

core 1.52.1 据え置きのまま上げられることを確認済み（バンドル・lint・テストとも緑）。同じ衛星グループの #1029 に検証内容をまとめてあります。同グループの @mastra/memory の workerd 実機確認が済んだらまとめてマージします。

[owk-owk130]

@dependabot rebase