zod v4: "additionalProperties: false" missing

Summary

We upgraded zod from v3 to v4. After the upgrade, all input schemas are missing additionalProperties: false in the tools/list response.

With zod@v3 the additionalProperties: false is returned correctly in the inputSchema.

zod: v3 and v4
@modelcontextprotocol/sdk: v1 and v2

Reproduction

Use the following example with zod@v3 and zod@v4:

const server = new McpServer({ name: "test-server", version: "1.0.0" });
server.registerTool(
  "test",
  {
    description: "Breaking input schema",
    inputSchema: { testInput: z.string() },
    outputSchema: { testOutput: z.string() },
  },
  async () => ({ content: [], structuredContent: { testOutput: "abc" } })
);

With zod@v4 we have this generated input schema

inputSchema: {
  type: "object"
  properties: { ... } 1 item
  required: [ ... ] 1 item
  $schema: "https://json-schema.org/draft/2020-12/schema"
}

But with zod@v3 we have this generated input schema

inputSchema: {
  type: "object"
  properties: { ... } 1 item
  required: [ ... ] 1 item
  $schema: "https://json-schema.org/draft/2020-12/schema"
  additionalProperties: false
}

Is this expected behavior or a bug?

Start at the McpServer.registerTool entry point and trace how its inputSchema is converted for the tools/list response, comparing the zod v3 and v4 reproductions shown here. Confirm the expected behavior with the project’s existing schema-generation tests or add a focused regression test; done means the zod v4 schema includes additionalProperties: false when appropriate.