SDK v2 migration (behavior-neutral, versionNegotiation: 'legacy') (#1624)

Migrate all three clients + core + test-servers from
@modelcontextprotocol/sdk@1.29 to SDK v2 (2.0.0-beta.4), keeping behavior
identical against legacy (2025-11-25) servers. Foundation for the SDK V2 +
New Spec stack.

Packages
- Split @modelcontextprotocol/sdk -> @modelcontextprotocol/client (Client,
  transports, OAuth, error taxonomy, protocol types) + core (Zod schemas);
  stdio -> client/stdio, Ajv -> client/validators/ajv. Test-servers ->
  @modelcontextprotocol/server (+ server-legacy/sse). Deterministic import
  rewrite (schemas -> core, everything else -> client); the codemod misroutes
  client code to /server so it was not used for path routing.
- new Client(..., { versionNegotiation: { mode: 'legacy' } }) — nothing
  2026-era goes on the wire.

Runtime (core/mcp/inspectorClient.ts)
- Error taxonomy: McpError -> ProtocolError, ErrorCode -> ProtocolErrorCode;
  RequestTimeout -> SdkError/SdkErrorCode.
- Handlers take method strings; task methods (tasks/*, notifications/tasks/*)
  use the 3-arg custom form (excluded from v2's spec-method set).
- Legacy tasks kept working (per project requirement): requestor tasks re-
  implemented over raw client.request + explicit deprecated schemas;
  experimental.tasks.callToolStream replaced by a local pollTaskToolCall
  async generator (with _progressHandlers revival so task-execution progress
  still reaches the caller). Receiver (server-initiated) tasks: the v2 Client
  validates a sampling/elicit handler result and rejects the legacy { task }
  response with -32602 — installReceiverTaskResponseBypass swaps the wrapped
  entry in the private _requestHandlers map for the task-augmented branch so
  { task } reaches the wire (fixes server-initiated sampling-via-task).
- Pagination: list verbs use raw client.request({method}, List*ResultSchema)
  for single-page behavior (v2's client.listX() auto-aggregate all pages).

Web / auth / apps
- Rename local JsonSchemaType -> InspectorFormSchema + add toFormSchema()
  structural narrowing at the SDK-schema -> form boundary.
- ext-apps still peers on SDK v1: one compat boundary with documented casts
  (remove when ext-apps#702 lands a v2 peer).
- OAuth provider saveClientInformation reconciled with v2's
  OAuthClientInformationContext; InvalidClientMetadataError re-homed as a
  local class (server-legacy/auth is not browser-safe).
- vitest.shared.mts dedupes @modelcontextprotocol/client+core to one copy so
  vi.mock intercepts the SUT's import.

Accepted v2 behavior changes (per #1624 / spec §9.2): unknown-tool call
rejects with -32602; cancellation is stream-abort (no guaranteed
notifications/cancelled frame); output-schema strictness restored via the
Inspector's own Ajv check on the default path.

npm run ci green: validate (web 3087 / cli 212 / tui 274 / launcher 5),
coverage (>=90 per-file, all clients), smoke (launcher/cli/web), storybook
(410).

Closes #1624

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/auth/cimd.ts

@@ -1,8 +1,5 @@
-import {
-  discoverAuthorizationServerMetadata,
-  discoverOAuthProtectedResourceMetadata,
-} from "@modelcontextprotocol/sdk/client/auth.js";
-import type { OAuthClientInformation } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { discoverAuthorizationServerMetadata, discoverOAuthProtectedResourceMetadata } from "@modelcontextprotocol/client";
+import type { OAuthClientInformation } from "@modelcontextprotocol/client";
 import { getAuthorizationServerUrl } from "./discovery.js";
 import type { BaseOAuthClientProvider } from "./providers.js";
 

core/auth/connection-state.ts

@@ -1,7 +1,4 @@
-import type {
-  OAuthClientInformation,
-  OAuthTokens,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { OAuthClientInformation, OAuthTokens } from "@modelcontextprotocol/client";
 import type { EnterpriseManagedAuthIdpConfig } from "../client/types.js";
 import { getEmaIdpLoginState, normalizeIdpIssuer } from "./ema/idpSession.js";
 import { idpOAuthStorageKey } from "./ema/storage.js";

core/auth/discovery.ts

@@ -1,5 +1,5 @@
-import { discoverAuthorizationServerMetadata } from "@modelcontextprotocol/sdk/client/auth.js";
-import type { OAuthProtectedResourceMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { discoverAuthorizationServerMetadata } from "@modelcontextprotocol/client";
+import type { OAuthProtectedResourceMetadata } from "@modelcontextprotocol/client";
 import { parseHttpUrl } from "./utils.js";
 
 /**

core/auth/ema/emaFlow.ts

@@ -1,4 +1,4 @@
-import type { OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { OAuthTokens } from "@modelcontextprotocol/client";
 import type { OAuthStorage } from "../storage.js";
 import type { EnterpriseManagedAuthIdpConfig } from "../../client/types.js";
 import {

core/auth/ema/idpOidc.ts

@@ -1,13 +1,6 @@
-import {
-  discoverAuthorizationServerMetadata,
-  exchangeAuthorization,
-  startAuthorization,
-} from "@modelcontextprotocol/sdk/client/auth.js";
-import type {
-  OAuthClientInformation,
-  OAuthMetadata,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
-import { OAuthMetadataSchema } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { discoverAuthorizationServerMetadata, exchangeAuthorization, startAuthorization } from "@modelcontextprotocol/client";
+import type { OAuthClientInformation, OAuthMetadata } from "@modelcontextprotocol/client";
+import { OAuthMetadataSchema } from "@modelcontextprotocol/core";
 import type { OAuthStorage } from "../storage.js";
 import type { EnterpriseManagedAuthIdpConfig } from "../../client/types.js";
 import { generateOAuthState, parseHttpUrl } from "../utils.js";

core/auth/ema/resourceContext.ts

@@ -1,10 +1,6 @@
-import {
-  discoverAuthorizationServerMetadata,
-  discoverOAuthProtectedResourceMetadata,
-  selectResourceURL,
-} from "@modelcontextprotocol/sdk/client/auth.js";
-import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
-import type { OAuthProtectedResourceMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { discoverAuthorizationServerMetadata, discoverOAuthProtectedResourceMetadata, selectResourceURL } from "@modelcontextprotocol/client";
+import type { OAuthClientProvider } from "@modelcontextprotocol/client";
+import type { OAuthProtectedResourceMetadata } from "@modelcontextprotocol/client";
 import { getAuthorizationServerUrl } from "../discovery.js";
 
 export interface EmaResourceContext {

core/auth/ema/tokenEndpoint.ts

@@ -1,8 +1,5 @@
-import { selectClientAuthMethod } from "@modelcontextprotocol/sdk/client/auth.js";
-import type {
-  OAuthClientInformation,
-  OAuthMetadata,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
+import { selectClientAuthMethod } from "@modelcontextprotocol/client";
+import type { OAuthClientInformation, OAuthMetadata } from "@modelcontextprotocol/client";
 
 export async function parseOAuthTokenErrorResponse(
   response: Response,

core/auth/ema/transportProvider.ts

@@ -1,9 +1,5 @@
-import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
-import type {
-  OAuthClientInformationMixed,
-  OAuthClientMetadata,
-  OAuthTokens,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { OAuthClientProvider } from "@modelcontextprotocol/client";
+import type { OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from "@modelcontextprotocol/client";
 import type { BaseOAuthClientProvider } from "../providers.js";
 import {
   refreshEmaResourceTokens,

core/auth/ema/wire.ts

@@ -1,9 +1,6 @@
-import { discoverAuthorizationServerMetadata } from "@modelcontextprotocol/sdk/client/auth.js";
-import type {
-  OAuthClientInformation,
-  OAuthTokens,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
-import { OAuthTokensSchema } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { discoverAuthorizationServerMetadata } from "@modelcontextprotocol/client";
+import type { OAuthClientInformation, OAuthTokens } from "@modelcontextprotocol/client";
+import { OAuthTokensSchema } from "@modelcontextprotocol/core";
 import type { EnterpriseManagedAuthIdpConfig } from "../../client/types.js";
 import {
   GRANT_TYPE_JWT_BEARER,

core/auth/mcpAuth.ts

@@ -10,17 +10,23 @@
  * (the same path v2 `auth()` takes when refresh cannot widen scope).
  */
 
-import {
-  auth as sdkAuth,
-  discoverOAuthServerInfo,
-  isHttpsUrl,
-  registerClient,
-  selectResourceURL,
-  startAuthorization,
-} from "@modelcontextprotocol/sdk/client/auth.js";
-import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
-import type { FetchLike } from "@modelcontextprotocol/sdk/shared/transport.js";
-import { InvalidClientMetadataError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import { auth as sdkAuth, discoverOAuthServerInfo, isHttpsUrl, registerClient, selectResourceURL, startAuthorization } from "@modelcontextprotocol/client";
+import type { OAuthClientProvider } from "@modelcontextprotocol/client";
+import type { FetchLike } from "@modelcontextprotocol/client";
+/**
+ * Thrown when the OAuth client metadata the Inspector would register is
+ * invalid (e.g. a non-HTTPS `clientMetadataUrl`). SDK v2 moved the original
+ * `InvalidClientMetadataError` into `@modelcontextprotocol/server-legacy`,
+ * whose `/auth` entry pulls in Node/Express server handlers that must never
+ * reach the browser bundle. This local class preserves the thrown type and
+ * message for the Inspector's client-side validation without that dependency.
+ */
+export class InvalidClientMetadataError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "InvalidClientMetadataError";
+  }
+}
 
 export type McpAuthResult = "AUTHORIZED" | "REDIRECT";
 

core/auth/oauth-storage.ts

@@ -1,12 +1,5 @@
-import type {
-  OAuthClientInformation,
-  OAuthTokens,
-  OAuthMetadata,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
-import {
-  OAuthClientInformationSchema,
-  OAuthTokensSchema,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { OAuthClientInformation, OAuthTokens, OAuthMetadata } from "@modelcontextprotocol/client";
+import { OAuthClientInformationSchema, OAuthTokensSchema } from "@modelcontextprotocol/core";
 import type { OAuthStorage } from "./storage.js";
 import { type OAuthMemoryStore, type ServerOAuthState } from "./store.js";
 import type { OAuthPersistBackend } from "./oauth-persist.js";

core/auth/providers.ts

@@ -1,10 +1,8 @@
-import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
 import type {
-  OAuthClientInformation,
-  OAuthClientMetadata,
-  OAuthTokens,
-  OAuthMetadata,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
+  OAuthClientProvider,
+  OAuthClientInformationContext,
+} from "@modelcontextprotocol/client";
+import type { OAuthClientInformation, OAuthClientMetadata, OAuthTokens, OAuthMetadata } from "@modelcontextprotocol/client";
 import type { OAuthStorage, SaveClientInformationOptions } from "./storage.js";
 import { generateOAuthState } from "./utils.js";
 
@@ -201,10 +199,19 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
 
   async saveClientInformation(
     clientInformation: OAuthClientInformation,
-    options?: SaveClientInformationOptions,
+    // SDK v2's `OAuthClientProvider.saveClientInformation` passes an
+    // `OAuthClientInformationContext` ({ issuer }); our own DCR/CIMD callers
+    // pass `SaveClientInformationOptions` ({ registrationKind }). Accept either
+    // and narrow on the discriminating key. Per-issuer keying (SEP-2352) is a
+    // later card — for now we only read the registration kind.
+    options?: SaveClientInformationOptions | OAuthClientInformationContext,
   ): Promise<void> {
+    const registrationKind =
+      options && "registrationKind" in options
+        ? options.registrationKind
+        : "dcr";
     await this.storage.saveClientInformation(this.serverUrl, clientInformation, {
-      registrationKind: options?.registrationKind ?? "dcr",
+      registrationKind,
     });
   }
 

core/auth/storage.ts

@@ -1,8 +1,4 @@
-import type {
-  OAuthClientInformation,
-  OAuthTokens,
-  OAuthMetadata,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { OAuthClientInformation, OAuthTokens, OAuthMetadata } from "@modelcontextprotocol/client";
 import type { OAuthClientRegistrationKind } from "./types.js";
 
 /**

core/auth/store.ts

@@ -3,11 +3,7 @@
  * Persisted via `OAuthStorageBase` + `OAuthPersistBackend` backends.
  */
 
-import type {
-  OAuthClientInformation,
-  OAuthTokens,
-  OAuthMetadata,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { OAuthClientInformation, OAuthTokens, OAuthMetadata } from "@modelcontextprotocol/client";
 import type {
   IdpSessionState,
   OAuthClientRegistrationKind,

core/auth/types.ts

@@ -1,10 +1,4 @@
-import type {
-  OAuthMetadata,
-  OAuthClientInformation,
-  OAuthClientInformationFull,
-  OAuthTokens,
-  OAuthProtectedResourceMetadata,
-} from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { OAuthMetadata, OAuthClientInformation, OAuthClientInformationFull, OAuthTokens, OAuthProtectedResourceMetadata } from "@modelcontextprotocol/client";
 
 // OAuth flow steps
 export type OAuthStep =