modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

chore: declare the MCP SDK packages only at the repo root (#1970)

Browse source 
The four v2 SDK packages (`client`, `core`, `server`, `server-legacy`) plus
`ext-apps` were declared in the root manifest *and* again in clients/web, cli,
and tui, so each client installed its own copy. Node resolution walks up and the
root install is on every client's chain — and the root manifest is already the
documented source of truth for what ships — so the per-client entries were
duplicates of a decision made at the root, and they had already drifted: before
this change the tree carried ext-apps 1.7.4 at the root and 1.7.5 under
clients/web, dragging in two copies of the v1 `@modelcontextprotocol/sdk`
(1.29.0 and 1.30.0) through ext-apps' peer dependency.

Nothing imports the v1 SDK; it is not in any manifest of ours, only a peer of
ext-apps, so consolidating ext-apps is the only lever over it. After a clean
install there is now exactly one copy of each, at the root. `npm update` then
moves ext-apps to 1.7.5 and its SDK peer to 1.30.0, whose widened
`@hono/node-server` range (`^1.19.9 || ^2.0.5`) also drops a nested duplicate of
that package.

`express` needed a real home to make this work. `test-servers/src` imports it,
but no manifest declared it: it was reaching `clients/cli/node_modules` only as
a peer of `express-rate-limit` under `@modelcontextprotocol/server-legacy`, so
removing that entry took express with it and every cli test that spawns a test
server failed to resolve it. It is now a root devDependency — test-servers is
root-owned code with no manifest of its own — and `vitest.shared.mts` resolves
it from the root, joining `yaml`, which was already the precedent for exactly
this case. The clients/web duplicate is dropped; its only reference is a
type-only import covered by `@types/express`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HDdo1rNRVQnVRRdsqSrvG3
This commit is contained in:
cliffhall 2026-08-11 09:07:04 -04:00
commit 31c41d3ad6
1 changed files with 50 additions and 2236 deletions
Download patch file Download diff file Expand all files Collapse all files

13
vitest.shared.mts
View file

@ -82,9 +82,20 @@ export function vitestSharedPaths(clientDir: string) {
find: /^@napi-rs\/keyring$/,
replacement: path.resolve(dirname, "node_modules/@napi-rs/keyring"),
},
// `express` and `yaml` resolve from the **repo root**, unlike every pin
// above. Both are reached only through root-owned code that has no manifest
// of its own — `test-servers/src` imports express, and `core`/the root
// tooling uses yaml — so the root is where they are declared and the only
// place a client's resolution chain is guaranteed to find them. Pointing
// these at `<client>/node_modules` is what broke when the MCP packages moved
// to the root (#1970): express was never declared by a client at all, it
// arrived in `clients/cli` as a peer of `express-rate-limit` under
// `@modelcontextprotocol/server-legacy`, so removing that manifest entry
// took express with it and every cli test that spawns a test server failed
// to resolve it.
{
find: /^express$/,
replacement: path.resolve(dirname, "node_modules/express"),
replacement: path.resolve(repoRoot, "node_modules/express"),
},
{
find: /^yaml$/,