Elicitation fails on edge runtimes with 'Code generation from strings disallowed'

Calling elicitInput from an MCP server on an edge runtime such as Cloudflare Workers throws EvalError during schema validation.

Difficulty

Easy

Time

~5 min

Steps

Fixed in

1.30.0

Last checked

Oct 17, 2026

Verified fix: PR #1012 merged on 2025-10-25. Fixed in 1.30.0 (first release published after the merge). Last checked 2026-10-17.

Symptom

Calling elicitInput from an MCP server on an edge runtime such as Cloudflare Workers throws EvalError during schema validation.

Evidence what you'll see

EvalError: Code generation from strings disallowed for this context
Stack trace runs through Ajv compile
Only on runtimes that block new Function

Cause

The TypeScript SDK validated elicitation schemas with Ajv, which generates code at runtime with new Function; edge runtimes forbid that.

Fix steps

0 of 2 done

Step 1Upgrade the MCP TypeScript SDK to a release that includes PR #1012, which adds pluggable JSON Schema validators.
Step 2Pass an edge-safe validator (the PR adds a @cfworker/json-schema provider) as jsonSchemaValidator on both Client and Server.

Your check marks stay in this browser only.

Verify the fix worked

Deploy to the edge runtime, call elicitInput and confirm the response validates without an EvalError.

Sources and credit

Summarized in our own words from these public reports. Credit goes to their authors.

Provided as is, without warranty. Try changes in a non-production environment and back up first. Security-related steps: verify against the official docs. Terms · Request removal or attribution change

Hit an error we don't cover? Submit it