chore(deps)(deps): bump @modelcontextprotocol/server from 2.0.0-alpha.2 to 2.0.0-beta.5

[dependabot]

Bumps @modelcontextprotocol/server from 2.0.0-alpha.2 to 2.0.0-beta.5.

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.0.0-beta.5

Patch Changes

• Updated dependencies [f413763]:
  • @​modelcontextprotocol/core@​2.0.0-beta.5

@​modelcontextprotocol/server@​2.0.0-beta.5

Minor Changes

• #2501 1480241 Thanks @​felixweinberger! - Export the Protocol base class and mergeCapabilities from the @modelcontextprotocol/client and @modelcontextprotocol/server package roots, restoring the v1 import for consumers that subclass Protocol (e.g. the MCP Apps SDK). The client and server packages each bundle their own compiled copy of the class, so import it from one package consistently within a process.

  The codemod now rewrites Protocol and mergeCapabilities imports from shared/protocol.js to the client or server package root, like the module's other symbols, instead of dropping them with an action-required marker.

• #2513 f413763 Thanks @​felixweinberger! - Align the 2026-07-28 wire with the final revision (spec PR #3002): serverInfo moves from the DiscoverResult body to the result _meta, and the per-request envelope's clientInfo demotes from required to SHOULD.

  Before this change the SDK shipped the pre-#3002 shape in both directions: the client hard-rejected a conforming server's DiscoverResult (missing body serverInfo failed parse, so the probe misclassified the server as legacy and attempted an initialize handshake against it — a hard connect failure against a modern-only server such as go-sdk v1.7.0-pre.3), and the server rejected conforming clients that omit clientInfo.

  Now:

  • The 2026 wire schemas are the final revision exactly: no body serverInfo on DiscoverResult, envelope clientInfo optional (a present-but-malformed value still fails validation).
  • Servers stamp _meta['io.modelcontextprotocol/serverInfo'] on every 2026-era response (spec SHOULD; a handler-authored value wins, the 2025-era wire is untouched). This includes the entry-built subscriptions/listen graceful-close results — the spec's SubscriptionsListenResultMeta extends ResultMetaObject.
  • Clients keep sending clientInfo and read server identity from the discover result's _meta only. A server that stamps no identity is anonymous: getServerVersion() is undefined and the response cache partitions under a per-connection surrogate. A malformed _meta serverInfo value is treated as absent on receive (the spec marks the field self-reported, unverified, and display-only).
  • Breaking type changes: DiscoverResult no longer declares serverInfo; RequestMetaEnvelope's clientInfo is optional. New public constant SERVER_INFO_META_KEY ('io.modelcontextprotocol/serverInfo').

Patch Changes

• Updated dependencies [f413763]:
  • @​modelcontextprotocol/core@​2.0.0-beta.5

@​modelcontextprotocol/server-legacy@​2.0.0-beta.4

Minor Changes

• #2477 8e1d2e9 Thanks @​felixweinberger! - Move the schema source modules (spec schemas, OAuth schemas, protocol constants) into @modelcontextprotocol/core and resolve them from there as a regular runtime dependency instead of bundling a private copy into each package. An application importing more than one of the packages now evaluates a single shared schema graph with shared object identity. @modelcontextprotocol/core gains a ./internal subpath (SDK-internal contract; may change in any release) and the four packages now version together.

Patch Changes

• #2476 e0a0ab7 Thanks @​felixweinberger! - Build protocol-revision wire schemas lazily on first validation instead of at import. Each revision's schema set is now constructed by a module-level memoized factory, so importing the client or server package no longer pays the construction cost of both frozen wire-schema graphs up front. Method membership in the revision registries stays static, the schemas themselves are unchanged, and registry lookups keep returning reference-identical schema objects.

• Updated dependencies [8e1d2e9]:

  • @​modelcontextprotocol/core@​2.0.0-beta.4

@​modelcontextprotocol/server@​2.0.0-beta.4

Minor Changes

• #2477 8e1d2e9 Thanks @​felixweinberger! - Move the schema source modules (spec schemas, OAuth schemas, protocol constants) into @modelcontextprotocol/core and resolve them from there as a regular runtime dependency instead of bundling a private copy into each package. An application importing more than one of the packages now evaluates a single shared schema graph with shared object identity. @modelcontextprotocol/core gains a ./internal subpath (SDK-internal contract; may change in any release) and the four packages now version together.

• #2483 3f07a32 Thanks @​felixweinberger! - Add preloadSchemas(), an explicit opt-in to eager wire-schema construction, and call it automatically in the Cloudflare Workers builds. The wire schemas are built lazily by default, which is the right trade on process-per-invocation runtimes — but on isolate platforms that bill request CPU while module evaluation runs during isolate warm-up, laziness moves construction into the first request each fresh isolate serves. Calling preloadSchemas() at module scope (it is synchronous and idempotent) moves that one-time cost back to module evaluation; the packages' workerd export condition now does this automatically, while the Node and browser builds stay lazy. The server package gains a dedicated browser shim for this (its browser condition previously reused the workerd shim), so browser bundles keep lazy construction.

Patch Changes

• #2458 7c49b47 Thanks @​felixweinberger! - Construct the default Ajv validation engine lazily on first validation. Creating a Client or Server no longer pays the ajv + ajv-formats instantiation cost at startup when no JSON Schema validation ever runs.

... (truncated)

Commits

• 1e1392e Version Packages (beta) (#2512)
• 6fe1963 fix(client): probe stdio servers on a disposable sibling process (#2514)
• f413763 Align 2026-07-28 wire with spec PR #3002: serverInfo in result _meta, clientI...
• f60dff0 feat(client): accept a cached era verdict on ConnectOptions.prior (#2511)
• 1480241 Export Protocol and mergeCapabilities from client/server package roots (#2501)
• e81758c Version Packages (beta) (#2484)
• ee8267a chore: version the codemod with the core SDK fixed group (#2486)
• 5db6e38 refactor(client): response cache stores serialized documents; drop structured...
• 3f07a32 perf: add preloadSchemas() and warm wire schemas eagerly on workerd (#2483)
• 8e1d2e9 refactor: move the schema source modules into @​modelcontextprotocol/core (#2477)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Medium Risk
The API’s MCP HTTP endpoint depends on this SDK; beta releases include 2026 wire-protocol and type changes that could affect MCP client interoperability without any code changes in this PR to adapt.

Overview
Bumps @modelcontextprotocol/server from 2.0.0-alpha.2 to 2.0.0-beta.5 in apps/api, with matching pnpm-lock.yaml updates. The server package now pulls in @modelcontextprotocol/core@2.0.0-beta.5 (replacing the prior optional @cfworker/json-schema peer setup); @modelcontextprotocol/hono remains on 2.0.0-alpha.2 but resolves against the new server version.

No application source changes—only dependency versions. Runtime MCP usage (McpServer, WebStandardStreamableHTTPServerTransport in the API MCP route) stays on the same imports.

^{Reviewed by Cursor Bugbot for commit 2fba62e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[cursor]

Threat-surface review

Verdict: No concrete security issues in the changed files. This PR only bumps @modelcontextprotocol/server 2.0.0-alpha.2 → 2.0.0-beta.5 in apps/api/package.json and pnpm-lock.yaml (adds transitive @modelcontextprotocol/core@2.0.0-beta.5). No application source changes.

Surfaces checked

1. MCP endpoint auth — Auth remains application-owned in apps/api/src/mcp/archmax-route.ts (authenticateRequest before transport.handleRequest, including session re-auth + token/project/slug binding). Tool registration in archmax-server.ts still receives a scoped McpAuthContext. The SDK bump does not move token checks into the library or alter that order. Invalid tokens still return JSON-RPC -32001 from app code, not a stack dump.

2. Query execution sandboxing — Not in the diff. execute_query / validateSqlAst paths are unchanged.

3. Admin auth (Better Auth) — Not in the diff.

4. API input validation — Not in the diff. MCP tool Zod schemas in archmax-server.ts are unchanged.

5. Environment secrets — No logging, response, or hardcoded-secret changes.

6. Dependency exposure —

   • OSV reports no advisories for @modelcontextprotocol/server@2.0.0-beta.5 or @modelcontextprotocol/core@2.0.0-beta.5.
   • pnpm audit --prod finds no MCP-package findings. Existing high findings (xlsx / @xmldom/xmldom via markitdown-ts) are pre-existing and not introduced here.
   • CVE-2026-25536 applies to legacy @modelcontextprotocol/sdk v1.x shared-transport reuse; this repo uses the v2 @modelcontextprotocol/server package and creates a new McpServer + transport per session init (stateful reuse only for that session).
   • Used APIs (McpServer, registerTool, WebStandardStreamableHTTPServerTransport + sessionIdGenerator / onsessioninitialized) remain present with the same options surface in beta.5.

Residual note (non-blocking)

@modelcontextprotocol/hono stays at 2.0.0-alpha.2 while server moves to 2.0.0-beta.5 (apps/api/package.json). Matching hono@2.0.0-beta.5 exists on npm; the alpha package is unused in source today, so this is version skew / peer hygiene rather than an active auth bypass. Prefer bumping (or removing) hono in lockstep with server on the next MCP dep PR.

  

_{Sent by Cursor Automation: archmax Security Review}

[github-actions]

Docker image ready

docker pull ghcr.io/archmaxai/archmax:pr-87