fix: align zod object schemas with stripped properties

Author: Genmin

packages/core/src/util/standardSchema.ts

@@ -188,7 +188,11 @@ export function standardSchemaToJsonSchema(schema: StandardJSONSchemaV1, io: 'in
                 `Wrap your schema in z.object({...}) or equivalent.`
         );
     }
-    return { type: 'object', ...result };
+    const jsonSchema: Record<string, unknown> = { type: 'object', ...result };
+    if (jsonSchema.properties !== undefined && !('additionalProperties' in jsonSchema) && !('unevaluatedProperties' in jsonSchema)) {
+        jsonSchema.additionalProperties = false;
+    }
+    return jsonSchema;
 }
 
 // Validation

packages/core/test/util/standardSchema.test.ts

@@ -39,4 +39,28 @@ describe('standardSchemaToJsonSchema', () => {
         expect(keys.filter(k => k === 'type')).toHaveLength(1);
         expect(result.type).toBe('object');
     });
+
+    test('marks default z.object schemas as not accepting additional properties', () => {
+        const schema = z.object({ message: z.string() });
+        const result = standardSchemaToJsonSchema(schema, 'input');
+
+        expect(result.additionalProperties).toBe(false);
+    });
+
+    test('preserves schemas that explicitly allow additional properties', () => {
+        const schema = z.object({ message: z.string() }).passthrough();
+        const result = standardSchemaToJsonSchema(schema, 'input');
+
+        expect(result.additionalProperties).toEqual({});
+    });
+
+    test('does not add root additionalProperties to union schemas', () => {
+        const schema = z.discriminatedUnion('action', [
+            z.object({ action: z.literal('create'), name: z.string() }),
+            z.object({ action: z.literal('delete'), id: z.string() })
+        ]);
+        const result = standardSchemaToJsonSchema(schema, 'input');
+
+        expect(result.additionalProperties).toBeUndefined();
+    });
 });

test/integration/test/server/mcp.test.ts

@@ -934,6 +934,7 @@ describe('Zod v4', () => {
             expect(result.tools[0]!.name).toBe('test');
             expect(result.tools[0]!.inputSchema).toMatchObject({
                 type: 'object',
+                additionalProperties: false,
                 properties: {
                     name: { type: 'string' },
                     value: { type: 'number' }