update MCP SDK to v1.25.1 and migrate to zod v4

[ndoschek]

What it does

• Update @modelcontextprotocol/sdk from v1.15.1 to v1.25.1
• Migrate zod from v3.23.8 to v4.2.1 to avoid type conflicts
• Update MCP tool registration API from server.tool() to server.registerTool()
• Replace zod-to-json-schema with native zod toJSONSchema() method
• Remove zod-to-json-schema dependency from ai-terminal package

Fixes GH-16615

How to test

• verify the mentioned filesystem mcp server works also with the latest version:

"ai-features.mcp.mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem@latest",
        "/some/path"
      ],
      "autostart": false
    }
}

• verify the theia mcp server works and that it still provides the test-tool. start the browser backend and test in a mcp client e.g. in VS Code:

{
	"servers": {
		"theia-mcp-server": {
			"url": "http://localhost:3000/mcp",
			"type": "http"
		}
	},
	"inputs": []
}

Follow-ups

Breaking changes

• This PR introduces breaking changes and requires careful review. If yes, the breaking changes section in the changelog has been updated.

Attribution

Review checklist

• As an author, I have thoroughly tested my changes and carefully followed the review guidelines
• User-facing text is internationalized using the nls service (for details, please see the Internationalization/Localization section in the Coding Guidelines)

Reminder for reviewers

• As a reviewer, I agree to behave in accordance with the review guidelines

[fipro78]

@ndoschek
I tested it locally and I can use the filesystem server. So it looks good to me. Now I can proceed with the implementation of the roots support.

[sdirix]

I will review at the latest next week.

[sdirix]

I tested the scenarios outlined in the PR.

The MCP server within Theia worked and the MCP server of Theia did work in VS Code. However in Roo Code the MCP integration breaks with this PR. Is there something we can do to be backwards compatible? Sadly they don't log any error so maybe we can't do too much.

---

Besides that I added a minor comment regarding imports and a larger one regarding the package-lock. We have duplicated zod libraries including an old version in it.

[sdirix]

All other imports look like this:

import { z } from 'zod';

[sdirix]

This looks like a duplicated dependency. @ai-sdk/provider-utils is now included multiple times in the same version, see for example node_modules/@ai-sdk/openai/node_modules/@ai-sdk/provider-utils

[ndoschek]

Good catch 👍
This looks like both @ai-sdk/openai and @ai-sdk/anthropic depend on @ai-sdk/provider-utils, and npm installs it under each package even though the versions match.

Since @ai-sdk/openai and @ai-sdk/anthropic are pulled in via the ai-vercel-ai package, I'd prefer not to touch or restructure those dependencies in this PR. I'll take another look at this on the next npm upgrade to see if we can upgrade those and remove the duplication.

[sdirix]

We still consume an old version here in ai-ide

[ndoschek]

Thanks for the review @sdirix!

Regarding the roo code extension:
According to Roo Code's MCP Server Transports documentation, the "transport": "streamable-http" setting should work with our current implementation, but the error stack trace mentioning "SSE error" suggests Roo may be falling back to or initially trying SSE regardless of the configuration.
We could add additional SSE transport support alongside Streamable HTTP for backwards compatibility (although the SSE is marked as legacy on their side).
But I think this is out of scope for this PR, but we could take a deeper look if it gets more relevant, wdyt?