modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

docs: correct the EMA spec's stale SDK-dependency claim

Browse source 
Review caught that v2_auth_ema.md contradicted itself. Its "TypeScript SDK
(implemented)" section claimed Inspector depends on `@modelcontextprotocol/sdk`
v1.x only (`^1.29.0`) and that there is "no `@modelcontextprotocol/client` v2
dependency in the tree today" — while the subsection immediately below it
documents which v2 client helpers the EMA legs have adopted.

Checked rather than assumed: every module the section's table names imports the
v2 client (emaFlow, idpOidc, resourceContext, tokenEndpoint, transportProvider,
wire, and providers.ts), and there are zero v1 SDK imports in first-party code.
The v1 SDK is present in the tree only as a peer pulled in by ext-apps, which
AGENTS.md already states must never become a direct dependency.

Rewrote the paragraph to say what is true and name the version, so it stays
consistent with the two auth specs corrected in the previous commit.

The per-row "v1 SDK" attributions in the table below it are wrong for the same
reason, but correcting each one means auditing which SDK symbol each leg calls
today — a real audit, not a version-string refresh, and out of scope for a
dependency bump. Left for a follow-up rather than guessed at here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HDdo1rNRVQnVRRdsqSrvG3
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-12 09:46:45 -04:00
commit 55878297d9
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
specification/v2_auth_ema.md
View file

@ -46,7 +46,7 @@ _Audited June 2026 against the [EMA extension spec](https://modelcontextprotocol
### TypeScript SDK (implemented)
Inspector depends on **`@modelcontextprotocol/sdk` v1.x** only (`^1.29.0` in root `package.json`). Standard OAuth and EMA both build on that package — there is **no** `@modelcontextprotocol/client` v2 dependency in the tree today.
Inspector depends on the **v2 SDK packages** — `@modelcontextprotocol/client` / `core` / `server` / `server-legacy` at **2.0.0**, declared in the root `package.json` only. Standard OAuth and EMA both build on `@modelcontextprotocol/client`; every module in the table below imports it. The v1 `@modelcontextprotocol/sdk` is **not** a dependency of this repo and must not become one — it appears in the lock files solely as a `peer` pulled in by `ext-apps`.
| Concern | Package / module |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |