@ai-sdk/mcp@0.0.36 Released: Fix for stdio Transport Environment Variable Issue

@ai-sdk/mcp@0.0.36 patches a bug where explicit stdio transport environment variables were silently dropped.
Vercel AI SDK released `@ai-sdk/mcp@0.0.36`, fixing a bug where environment variables explicitly set by developers could be discarded or silently overridden when spawning MCP child processes via stdio transport. Since environment variables carry critical config like API keys and auth tokens in this mode, the bug caused issues like authentication failures that were hard to trace. The module is still in early 0.0.x stage — production users are advised to upgrade promptly and pin their version.
Vercel's AI SDK ecosystem has received a patch update for the MCP (Model Context Protocol) module — @ai-sdk/mcp@0.0.36. This is a classic patch-level fix. While the version bump is minor, it resolves a real runtime issue for developers relying on stdio transport.
What's in This Update
According to the GitHub Release page, this version was published by github-actions on September 25th. It's a commit on the main branch of the vercel/ai repository, verified with an official GitHub GPG signature (GPG Key ID: B5690EEEBB952194).
The changelog lists a single change — one Patch Change:
fix(mcp): preserve explicit stdio transport environment values
This means that in previous versions, when developers launched an MCP server using stdio transport, explicitly passed environment variables might not have been correctly preserved or applied. This fix ensures those values are properly forwarded to the child process as intended.

MCP (Model Context Protocol) was proposed and open-sourced by Anthropic in late 2024. It aims to provide large language models with a standardized interface for tool invocation and context retrieval — essentially the USB-C of AI, enabling models to connect to file systems, databases, browser automation, external APIs, and more through a unified interface. The Vercel AI SDK implements the client-side of this protocol via the @ai-sdk/mcp package, allowing developers to call MCP-compliant tool servers directly from Next.js, Node.js, and similar environments — without manually handling low-level protocol details or process management. Since the MCP ecosystem is still rapidly taking shape, all major AI SDKs are actively iterating on their support for it, and foundational reliability patches like this environment variable fix are among the most common and critical updates in early versions.
Why stdio Transport Environment Variables Matter
MCP is a protocol for connecting AI models to external tools and data sources. In practice, stdio transport is one of the most commonly used communication methods — it communicates with a locally spawned child process via standard input/output.
In this mode, environment variables often carry critical configuration such as API keys, authentication tokens, runtime paths, or debug flags. If the SDK fails to correctly preserve the environment variables explicitly specified by the developer when spawning the child process, the child process may read incorrect or missing configuration — leading to hard-to-debug issues like authentication failures or connection errors.
The fix in version 0.0.36 targets exactly this scenario, ensuring that "explicitly set" environment values are not discarded or accidentally reset during transport.
stdio transport (Standard Input/Output Transport) is an inter-process communication mechanism where the parent process sends requests by writing to the child process's stdin, and reads responses from the child process's stdout. Unlike network-based transports using HTTP or WebSocket, stdio requires no open network ports and is naturally well-suited for running untrusted tool processes in local sandboxes with strong security isolation. In MCP's architecture, the host application (such as an AI assistant or IDE plugin) typically spawns a local MCP Server process via stdio, with both sides exchanging JSON-RPC messages according to the protocol format. The child process's runtime environment is entirely injected by the parent at spawn or fork time via the env parameter. If the SDK has a merging logic error at this step — for example, overriding developer-supplied values with system defaults — the child process starts in a "broken" environment. The resulting errors typically only manifest as authentication failures or feature malfunctions, making the root cause extremely difficult to trace.
Practical Impact for Developers
For teams integrating MCP toolchains with the AI SDK, this is a patch update worth applying promptly. If you've ever encountered the puzzling behavior of environment variables "being set but having no effect" when using stdio transport, upgrading to this version will very likely fix the problem directly.
The version number (0.0.x) indicates that @ai-sdk/mcp is still in early-stage iteration, and both its API and behavior may evolve rapidly across versions. Developers are advised to pin specific version numbers in production environments and review the full changelog before upgrading.
It's also worth noting that the vercel/ai repository itself has over 27k stars and 5.2k forks, with more than 4,300 commits on the main branch — a sign of a highly active SDK ecosystem where MCP-related modules are being continuously and rapidly improved.
Summary
@ai-sdk/mcp@0.0.36 is a focused, clearly scoped patch release. While the changelog contains just a single fix, correct environment variable forwarding is directly tied to whether MCP applications using stdio transport can run stably. Modules in early-stage versions particularly need this kind of foundational reliability fix — and it reflects the AI SDK team's ongoing commitment to the MCP ecosystem.
Related articles

Chain of Thought Isn't Just for AI: How Humans Can Use CoT to Improve Thinking Quality
Chain of Thought isn't just a prompt trick for large models. Starting from a Hacker News discussion, this article analyzes why CoT works for human thinking too, breaks down actionable ways to transfer it, and highlights the key differences between human CoT and machine CoT.
Cloudflare Teams Up with OpenAI: Closi…
Cloudflare Teams Up with OpenAI: Closing the Loop from Vulnerability Discovery to Defense with AI
Cloudflare uses OpenAI Daybreak to investigate security vulnerabilities and generate reviewable remediation plans, while developers use Codex to boost coding efficiency and quality.

Orca Multi-Agent Orchestration in Practice: A Guide to Parallel Collaboration with Claude and Codex
Orca is Stable AI's free open-source agent workbench supporting 34 agents like Claude Code and Codex in parallel. Learn its Git worktree isolation, multi-model orchestration, and mobile management.