npm deprecate @modelcontextprotocol/server-filesystem@<=2025.8.21 (empty tool schemas under zod v4)

Follow-up to #4661, which is fixed in the package but not communicated to anyone still pinned to an old version.

What's wrong

Every published server-filesystem up to and including 2025.8.21 calls zodToJsonSchema directly to build its tool schemas. zod-to-json-schema is zod-v3-only, and none of these versions pin zod — it resolves transitively through the SDK. A fresh install today lands on zod 4.x, the conversion silently returns {}, and the server advertises nearly every tool as a bare {"$schema": "http://json-schema.org/draft-07/schema#"}. Strict clients then reject the server at tools/list.

The failure is silent and misattributed — it surfaces client-side as what looks like a permissions or sandbox problem. The reporter on #4661 spent several weeks looking at their own folder configuration before finding it.

Affected versions

All 13 published versions <=2025.8.21. Verified against the published tarballs, not main:

list_allowed_directories survives in every case because its schema is a literal object rather than a converted one.

Fixed from 2025.11.25 onward by the registerTool migration, which dropped zodToJsonSchema entirely. 2026.7.10 removed the dependency. Current main has no zod-to-json-schema usage anywhere in src, and no currently published TypeScript server declares it.

Requested action

npm deprecate '@modelcontextprotocol/server-filesystem@<=2025.8.21' \
  'Broken with zod v4: tool input schemas are emitted empty. Upgrade to 2025.11.25 or later.'

Needs someone with publish rights on the @modelcontextprotocol npm scope.

Related but distinct: #4266 asks about deprecating whole stale packages. This one is a version-range deprecation on a package that is actively maintained and whose current release is fine.

Start by reviewing the affected published versions and verifying the package metadata and deprecation permissions with npm. Run the requested npm deprecate command for @modelcontextprotocol/server-filesystem versions <=2025.8.21; done means npm shows the warning on those versions and leaves 2025.11.25 and later unaffected.