diff --git a/package-lock.json b/package-lock.json
index 32f9193..ea1b355 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -14,7 +14,7 @@
         "commander": "^12.0.0",
         "pino": "^10.3.1",
         "yaml": "^2.4.0",
-        "zod": "^3.23.0"
+        "zod": "^4.3.6"
       },
       "bin": {
         "mcp-contract-kit": "dist/src/cli.js"
@@ -4534,9 +4534,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "3.25.76",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
-      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
+      "version": "4.3.6",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.3.6.tgz",
+      "integrity": "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
diff --git a/package.json b/package.json
index b43b508..b824a94 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "commander": "^12.0.0",
     "pino": "^10.3.1",
     "yaml": "^2.4.0",
-    "zod": "^3.23.0"
+    "zod": "^4.3.6"
   },
   "devDependencies": {
     "@types/cli-progress": "^3.11.5",
diff --git a/src/types/schemas.ts b/src/types/schemas.ts
index 16b278f..7139d31 100644
--- a/src/types/schemas.ts
+++ b/src/types/schemas.ts
@@ -42,7 +42,7 @@ export const MCPRequestSchema = z.object({
   jsonrpc: z.literal('2.0'),
   method: z.string().min(1),
   id: z.union([z.string(), z.number()]),
-  params: z.record(z.unknown()).optional(),
+  params: z.record(z.string(), z.unknown()).optional(),
 });
 
 /**
@@ -82,7 +82,7 @@ export const ToolDefinitionSchema = z.object({
       'Tool name must start with lowercase letter and contain only lowercase letters, numbers, underscores, and hyphens',
     ),
   description: z.string().min(1, 'description is required'),
-  inputSchema: z.record(z.unknown()),
+  inputSchema: z.record(z.string(), z.unknown()),
 });
 
 /** Type inference */
@@ -98,7 +98,7 @@ export const AgentRequestContractSchema = z.object({
   raw_input: z.string().min(1, 'raw_input is required'),
   display_name: z.string().optional(),
   intent_summary: z.string().optional(),
-  entities: z.record(z.unknown()).optional(),
+  entities: z.record(z.string(), z.unknown()).optional(),
   turn_history: z
     .array(
       z.object({
@@ -107,7 +107,7 @@ export const AgentRequestContractSchema = z.object({
       }),
     )
     .optional(),
-  workflow_state: z.record(z.unknown()).optional(),
+  workflow_state: z.record(z.string(), z.unknown()).optional(),
 });
 
 /** Type inference */
@@ -119,7 +119,7 @@ export type AgentRequestContract = z.infer<typeof AgentRequestContractSchema>;
 export const AgentResponseContractSchema = z.object({
   content: z.string().min(1, 'content must be a non-empty string'),
   workflow_complete: z.boolean(),
-  workflow_state: z.record(z.unknown()).optional(),
+  workflow_state: z.record(z.string(), z.unknown()).optional(),
   isError: z.boolean().optional(),
   errorMessage: z.string().optional(),
 });