
Company News
Andrew Becherer Joins Socket as Chief Information Security Officer
Socket’s first CISO brings deep experience securing high-growth SaaS companies as open source supply chain threats accelerate.
@mcp-layer/schema
Advanced tools
@mcp-layer/schema extracts MCP server definitions (tools, resources, prompts, templates, and MCP Apps metadata) and normalizes them into a unified Zod-backed schema. The output is designed for downstream generators that need a single contract to build CLIs, REST endpoints, UI renderers, or additional MCP layers without re-parsing the MCP protocol surface.
pnpm add @mcp-layer/schema
# or
npm install @mcp-layer/schema
# or
yarn add @mcp-layer/schema
import { load } from '@mcp-layer/config';
import { connect } from '@mcp-layer/connect';
import { extract } from '@mcp-layer/schema';
const config = await load(undefined, process.cwd());
const session = await connect(config, 'demo');
const output = await extract(session);
console.log(output.server.info);
console.log(output.items[0]);
await session.close();
tools/list, resources/list, resources/templates/list, prompts/list) using pagination.detail.input shape.The package returns:
{
server: {
info, // initialize.serverInfo
capabilities, // initialize.capabilities
instructions // initialize.instructions (optional)
},
items: [
{
type, // "tool" | "resource" | "resource-template" | "prompt"
name,
title,
description,
meta, // icons, annotations, _meta
detail // type-specific data
}
]
}
Type discriminator:
tool, resource, resource-template, prompttype; tools remain tool and UI resources remain resource.detail: {
input: {
schema, // Zod schema (Ajv-backed)
json, // original JSON Schema
error // optional Ajv compile error message
},
output: { schema, json, error }, // only when the tool advertises outputSchema
ui: { resourceUri, csp, permissions } // when _meta.ui is present (MCP Apps)
}
detail: {
uri,
mimeType,
size,
ui: { resourceUri, csp, permissions } // when _meta.ui is present (MCP Apps)
}
detail: {
uriTemplate,
mimeType
}
detail: {
input: {
schema, // Zod schema derived from prompt arguments
json, // JSON Schema derived from prompt arguments
error // optional Ajv compile error message
}
}
If a server exposes MCP Apps metadata:
_meta.ui.resourceUri pointing to a ui:// resource._meta.ui with CSP and permissions.This package normalizes those fields into detail.ui so generators can:
ui:// resource.Suggested uses for the unified schema:
name, description, and detail.input to build flags and help text.name for endpoints, detail.input.json for request validation, and detail.output for response schema.detail.ui.resourceUri to locate the UI and read detail.ui.csp / permissions.Session from @mcp-layer/connect or @mcp-layer/attach.session.close() after extraction.detail.input.error or detail.output.error will be populated for that item.items array (not an error).Zod validators are produced to allow direct runtime validation, but the original JSON Schema is preserved in detail.input.json and detail.output.json so generators can emit OpenAPI, JSON Schema, or other schema formats without losing fidelity.
This section is written for high-pressure debugging moments. Each entry maps directly to schema extraction preconditions.
Thrown from: extract
This happens when extract(link) is called without a connected Session object (or with an object that does not expose .client). The extractor relies on MCP client capabilities and list calls.
Step-by-step resolution:
Session returned by connect(...) or attach(...).session.client is available.Session.const session = await connect(config, 'local-dev');
const catalog = await extract(session);
console.log(catalog.items.length);
await session.close();
MIT
FAQs
Extract and normalize MCP schemas into a unified Zod-based format.
We found that @mcp-layer/schema demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Socket’s first CISO brings deep experience securing high-growth SaaS companies as open source supply chain threats accelerate.

Company News
Replit is integrating Socket Firewall into its AI-powered development experience to help protect builders from malicious open source packages.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.