@agent-native/core 0.128.4 → 0.129.0

package/src/mcp/server.ts

@@ -46,33 +46,6 @@ export {
 };
 export type { MCPConfig, MCPCallerIdentity, MCPRequestMeta };
 
-// ---------------------------------------------------------------------------
-// Runtime detection — Node fast-path vs. web-standard fallback
-// ---------------------------------------------------------------------------
-
-/**
- * Resolve the underlying Node `http` req/res pair if (and only if) we're
- * running on a real Node HTTP server (local dev, `node` Nitro preset). On the
- * web-standard runtime (Nitro 3 / Netlify web runtime, Cloudflare, Deno, Bun)
- * BOTH of these are undefined — that's the signal to take the web fallback
- * instead of returning 501.
- */
-function getNodeReqRes(event: H3Event): {
-  nodeReq: any | undefined;
-  nodeRes: any | undefined;
-} {
-  const e = event as any;
-  const nodeReq = e.node?.req ?? e.req?.runtime?.node?.req;
-  const nodeRes = e.node?.res ?? e.req?.runtime?.node?.res;
-  return { nodeReq, nodeRes };
-}
-
-function shouldUseNodeFastPath(event: H3Event): boolean {
-  if (process.env.AGENT_NATIVE_MCP_NODE_FAST_PATH !== "1") return false;
-  const { nodeReq, nodeRes } = getNodeReqRes(event);
-  return Boolean(nodeReq && nodeRes);
-}
-
 /**
  * Derive the request origin + the markdown deep-link target from the inbound
  * headers. Identical logic for both the Node and web paths so the absolute
@@ -254,29 +227,20 @@ function buildUnauthorizedBody(event: H3Event): {
 /**
  * Handle a single `{routePrefix}/mcp` request on either runtime.
  *
- * - **Default path:** build the SAME MCP `Server`
- *   from the SAME config + identity, drive it through the SDK's
- *   `WebStandardStreamableHTTPServerTransport` (which the Node transport is
- *   itself just a thin wrapper around), and return the resulting Web
- *   `Response` as a normal h3 return value. This is used for Nitro local dev
- *   too; the direct Node writer can otherwise race h3 and double-write.
- * - **Opt-in Node fast-path:** set `AGENT_NATIVE_MCP_NODE_FAST_PATH=1` to
- *   delegate directly to the SDK's `StreamableHTTPServerTransport`.
+ * Builds one request-scoped MCP `Server` from the verified caller identity and
+ * drives it through the SDK's v2 `createMcpHandler`. That entry serves native
+ * 2026-07-28 envelopes and stateless 2025-era traffic from the same factory,
+ * so protocol generations cannot drift apart.
  *
- * Auth, the `runWithRequestContext` identity wrap, the deep-link `_meta` /
- * markdown append, `requestMeta` origin/target derivation and the stateless
- * semantics are IDENTICAL on both paths because both build the same server
- * via `createMCPServerForRequest` and both transports funnel into the same
- * `WebStandardStreamableHTTPServerTransport.handleRequest(webRequest, {
- * parsedBody })` with the same options.
+ * The handler is Web Standard on every runtime. H3 owns the Node response when
+ * one exists, avoiding the double-write race from a transport writing directly
+ * to `node.res`.
  *
  * Returns:
  *   - `undefined` when the request targets a sub-route (so management/status
  *     routes mounted under `/_agent-native/mcp/*` handle it themselves) — the
  *     h3 mount falls through to the next handler.
- *   - a Web `Response` (web fallback) or a string/object (Node path /
- *     auth-error path) otherwise. The Node path also sets `_handled` so h3
- *     doesn't double-write.
+ *   - a Web `Response` or an auth-error object otherwise.
  */
 export async function handleMcpRequest(
   event: H3Event,
@@ -330,26 +294,9 @@ export async function handleMcpRequest(
     return buildUnauthorizedBody(event);
   }
 
-  // Stateless mode: only POST is meaningful. A stateless, per-request transport
-  // on serverless cannot keep the standalone GET SSE stream (server->client
-  // channel) alive across invocations — once the function returns and freezes,
-  // that stream dies and the client reports "session expired" / "not
-  // connected". The spec lets a server that offers no GET stream answer 405, so
-  // the client falls back to plain POST request/response. Reject GET here
-  // instead of letting the SDK open a doomed stream.
-  if (method === "DELETE") {
-    setResponseStatus(event, 204);
-    return "";
-  }
-
-  if (method !== "POST") {
-    setResponseStatus(event, 405);
-    return { error: "Method not allowed" };
-  }
-
-  // Read body for POST (GET has no body). Read it via the h3 helper exactly
-  // once; both transports accept it as a pre-parsed body so the request
-  // stream is never consumed twice.
+  // Read POST bodies through h3 exactly once. `createMcpHandler` accepts the
+  // parsed value, so neither its modern classifier nor its legacy fallback
+  // consumes the request stream a second time.
   const body = method === "POST" ? await readBody(event) : undefined;
 
   // Optional diagnostics for host capability negotiation. Keep disabled by
@@ -372,13 +319,7 @@ export async function handleMcpRequest(
     }
   }
 
-  // Per-request stateless transport + server. Both runtimes build the SAME
-  // server from the SAME config + verified identity + request meta, so
-  // tools/list, tools/call, and the deep-link `_meta` are identical. A
-  // connected real caller (connect-minted token / `mcp install` /
-  // ACCESS_TOKEN / production) gets the full action surface even in local
-  // dev; unauthenticated dev probes stay sparse. See `external-agents` skill.
-  const server = await createMCPServerForRequest(config, authResult.identity, {
+  const serverRequestMeta: MCPRequestMeta = {
     ...requestMeta,
     fullSurface: authResult.fullSurface === true,
     inlineMcpApps:
@@ -389,76 +330,23 @@ export async function handleMcpRequest(
     // When the caller minted their token with --full-catalog (catalog_scope:
     // "full" JWT claim), bypass the connector-catalog tier filter.
     ...(authResult.fullCatalog === true ? { fullCatalog: true } : {}),
-  });
-
-  if (shouldUseNodeFastPath(event)) {
-    const { nodeReq, nodeRes } = getNodeReqRes(event);
-    // ---- Opt-in Node fast-path ---------------------------------------------
-    const { StreamableHTTPServerTransport } =
-      await import("@modelcontextprotocol/sdk/server/streamableHttp.js");
-    const transport = new StreamableHTTPServerTransport({
-      sessionIdGenerator: undefined, // stateless
-      // Return JSON request/response instead of SSE. A stateless serverless
-      // instance can freeze right after returning a streaming Response, before
-      // the deferred SSE result event is flushed — the client then never gets
-      // the tools/call result and reports "session expired". JSON mode awaits
-      // the result inside the request lifecycle and returns it as one body.
-      enableJsonResponse: true,
-    });
-    await server.connect(transport);
-    try {
-      // The SDK transport writes directly to the Node response. Node-only by
-      // construction; we only reach here when real Node req/res exist.
-      await transport.handleRequest(nodeReq, nodeRes, body);
-    } catch (err: any) {
-      // The SDK transport writes directly to the Node response. If the socket
-      // is already closed/ended (client disconnected, or the host stream
-      // layer also flushed), Node throws ERR_STREAM_WRITE_AFTER_END *after*
-      // the MCP payload was already delivered correctly. Swallow that benign
-      // post-flush write so an external agent disconnecting mid-stream can
-      // never take down the server process; rethrow anything else.
-      if (err?.code !== "ERR_STREAM_WRITE_AFTER_END") throw err;
-      if (process.env.DEBUG)
-        console.log(
-          "[mcp] ignored post-flush ERR_STREAM_WRITE_AFTER_END (client disconnected)",
-        );
-    }
-    // Prevent H3 from double-writing the response
-    (event as any)._handled = true;
-    return undefined;
-  }
-
-  // ---- Web-standard response path (Nitro local dev, Netlify web runtime, CF,
-  // Deno, Bun) ---------------------------------------------------------------
-  //
-  // `StreamableHTTPServerTransport` is itself just a thin wrapper that
-  // converts the Node req/res to a web Request/Response and delegates to
-  // `WebStandardStreamableHTTPServerTransport.handleRequest(webRequest, {
-  // parsedBody })`. Using the web transport directly with the SAME options +
-  // the same pre-read `parsedBody` produces byte-identical protocol output
-  // (including the deep-link `_meta` built inside createMCPServerForRequest),
-  // and works on every web runtime because it returns a Web `Response`
-  // (JSON for request/response, or an SSE `ReadableStream` body which h3
-  // streams natively).
-  const { WebStandardStreamableHTTPServerTransport } =
-    await import("@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js");
-  const transport = new WebStandardStreamableHTTPServerTransport({
-    sessionIdGenerator: undefined, // stateless — same as the Node path
-    // JSON request/response (not SSE) — see the Node fast-path note above.
-    // This is the serverless-safe framing: the result is computed and returned
-    // within the request, never pushed onto a stream after the instance froze.
-    enableJsonResponse: true,
-  });
-  await server.connect(transport);
+  };
+  const { createMcpHandler } = await import("@modelcontextprotocol/server");
+  const handler = createMcpHandler(
+    () =>
+      createMCPServerForRequest(config, authResult.identity, serverRequestMeta),
+    {
+      legacy: "stateless",
+      // Ordinary calls stay single-body JSON unless a handler emits a related
+      // message before its result. Subscription/listen remains SSE.
+      responseMode: "auto",
+    },
+  );
   const webRequest = buildWebRequest(event, method);
-  // `parsedBody: undefined` would make the SDK try to read `req.json()`; our
-  // synthesized request has no body, so only pass the option for POST (where
-  // we actually have a parsed body). For GET the transport reads no body.
-  const response = await transport.handleRequest(
+  return handler.fetch(
     webRequest,
     method === "POST" ? { parsedBody: body } : undefined,
   );
-  return response;
 }
 
 // ---------------------------------------------------------------------------
@@ -471,14 +359,10 @@ export async function handleMcpRequest(
  * Endpoints: `/mcp` (public) and `/_agent-native/mcp` (compatibility).
  * A custom route prefix only mounts that custom endpoint.
  *
- * Uses stateless Streamable HTTP transport — no in-memory sessions, JSON
- * request/response (no SSE), and no standalone GET stream, so it survives
- * serverless instances that freeze between invocations (SSE framing there
- * drops the result and clients report "session expired"). Runtime-agnostic: a real Node
- * server uses the SDK's Node transport; the web-standard runtime (Nitro 3 /
- * Netlify web runtime, Cloudflare, Deno, Bun) uses the SDK's web-standard
- * transport. Both build the same server and produce identical JSON-RPC
- * output.
+ * Uses the v2 Web Standard per-request handler with native 2026-07-28 serving
+ * and stateless 2025-era fallback. It carries no in-memory protocol session
+ * across invocations and works unchanged on Node, Nitro/Netlify web runtimes,
+ * Cloudflare, Deno, and Bun.
  *
  * Auth: Bearer token matching ACCESS_TOKEN/ACCESS_TOKENS or JWT via A2A_SECRET.
  * No auth required when neither is configured (dev mode).

package/src/mcp/stdio.ts

@@ -24,8 +24,6 @@
  * of the serverless bundle.
  */
 
-import type { ServerCapabilities } from "@modelcontextprotocol/sdk/types.js";
-
 import {
   MCP_LEGACY_ROUTE_PREFIX,
   MCP_PUBLIC_ROUTE_PREFIX,
@@ -143,19 +141,10 @@ async function runProxy(opts: RunMCPStdioOptions): Promise<void> {
   }
   const target = `${origin}${mcpSubpath}`;
 
-  const { Client } = await import("@modelcontextprotocol/sdk/client/index.js");
-  const { StreamableHTTPClientTransport } =
-    await import("@modelcontextprotocol/sdk/client/streamableHttp.js");
-  const { Server } = await import("@modelcontextprotocol/sdk/server/index.js");
-  const { StdioServerTransport } =
-    await import("@modelcontextprotocol/sdk/server/stdio.js");
-  const {
-    ListToolsRequestSchema,
-    CallToolRequestSchema,
-    ListResourcesRequestSchema,
-    ReadResourceRequestSchema,
-    ListResourceTemplatesRequestSchema,
-  } = await import("@modelcontextprotocol/sdk/types.js");
+  const { Client, StreamableHTTPClientTransport } =
+    await import("@modelcontextprotocol/client");
+  const { Server } = await import("@modelcontextprotocol/server");
+  const { serveStdio } = await import("@modelcontextprotocol/server/stdio");
 
   // --- Upstream HTTP client -------------------------------------------------
   const clientTransport = new StreamableHTTPClientTransport(new URL(target), {
@@ -163,69 +152,72 @@ async function runProxy(opts: RunMCPStdioOptions): Promise<void> {
   });
   const client = new Client(
     { name: "agent-native-mcp-proxy", version: "1.0.0" },
-    { capabilities: {} },
+    {
+      capabilities: {},
+      versionNegotiation: { mode: "auto" },
+    },
   );
   await client.connect(clientTransport);
   log(`Proxying stdio ⇄ ${target} (app: ${appId})`);
 
   // --- Downstream stdio server ---------------------------------------------
   const upstreamCapabilities = client.getServerCapabilities();
-  const capabilities: ServerCapabilities = { tools: {} };
+  const capabilities: NonNullable<
+    ReturnType<typeof client.getServerCapabilities>
+  > = { tools: {} };
   if (upstreamCapabilities?.resources) capabilities.resources = {};
   if (upstreamCapabilities?.extensions) {
     capabilities.extensions = upstreamCapabilities.extensions;
   }
 
-  const server = new Server(
-    { name: `agent-native-${appId}`, version: "1.0.0" },
-    { capabilities },
-  );
+  const stdio = serveStdio(
+    () => {
+      const server = new Server(
+        { name: `agent-native-${appId}`, version: "1.0.0" },
+        { capabilities },
+      );
 
-  server.setRequestHandler(ListToolsRequestSchema, async (request: any) => {
-    return client.listTools(request.params);
-  });
+      server.setRequestHandler("tools/list", async (request: any) => {
+        return client.listTools(request.params);
+      });
 
-  server.setRequestHandler(CallToolRequestSchema, async (request: any) => {
-    // Forward the call verbatim; the upstream appends the deep-link block.
-    return client.callTool(request.params);
-  });
+      server.setRequestHandler("tools/call", async (request: any) => {
+        // Forward the call verbatim; the upstream appends the deep-link block.
+        return client.callTool(request.params);
+      });
 
-  if (upstreamCapabilities?.resources) {
-    server.setRequestHandler(
-      ListResourcesRequestSchema,
-      async (request: any) => {
-        return client.listResources(request.params);
-      },
-    );
-
-    server.setRequestHandler(
-      ListResourceTemplatesRequestSchema,
-      async (request: any) => {
-        return client.listResourceTemplates(request.params);
-      },
-    );
+      if (upstreamCapabilities?.resources) {
+        server.setRequestHandler("resources/list", async (request: any) => {
+          return client.listResources(request.params);
+        });
 
-    server.setRequestHandler(
-      ReadResourceRequestSchema,
-      async (request: any) => {
-        return client.readResource(request.params);
-      },
-    );
-  }
+        server.setRequestHandler(
+          "resources/templates/list",
+          async (request: any) => {
+            return client.listResourceTemplates(request.params);
+          },
+        );
 
-  const stdioTransport = new StdioServerTransport();
-  await server.connect(stdioTransport);
+        server.setRequestHandler("resources/read", async (request: any) => {
+          return client.readResource(request.params);
+        });
+      }
+      return server;
+    },
+    { legacy: "serve" },
+  );
 
   // Keep the proxy alive until the client/transport closes.
   await new Promise<void>((resolve) => {
     const done = () => resolve();
-    stdioTransport.onclose = done;
     clientTransport.onclose = done;
+    process.stdin.once("end", done);
     process.once("SIGINT", done);
     process.once("SIGTERM", done);
   });
 
   try {
+    await stdio.close();
     await client.close();
   } catch {
     // best-effort
@@ -264,44 +256,44 @@ async function runStandalone(opts: RunMCPStdioOptions): Promise<void> {
 
   const { autoDiscoverActions } = await import("../server/action-discovery.js");
   const { createMCPServerForRequest } = await import("./build-server.js");
-  const { StdioServerTransport } =
-    await import("@modelcontextprotocol/sdk/server/stdio.js");
+  const { serveStdio } = await import("@modelcontextprotocol/server/stdio");
 
   const actions = await autoDiscoverActions(cwd);
   log(
     `Standalone: discovered ${Object.keys(actions).length} action(s) in ${cwd}`,
   );
 
-  const server = await createMCPServerForRequest(
-    {
-      name: appId.charAt(0).toUpperCase() + appId.slice(1),
-      appId,
-      description: `Agent-native ${appId} app (standalone MCP)`,
-      actions,
-      // No askAgent in standalone — there is no running engine/runtime here.
-      // builtin cross-app tools stay on so `list_apps` / `open_app` /
-      // `create_workspace_app` / `list_templates` still work from disk.
-    },
-    // No verified identity in standalone (no inbound auth header). Runs with
-    // platform-default scope, same as a tokenless local HTTP mount.
-    undefined,
-    {
-      origin,
-      clientName: "agent-native-mcp-standalone",
-      // Compact by default; opt into the full catalog with the env flag.
-      fullCatalog: process.env.AGENT_NATIVE_MCP_FULL_CATALOG === "1",
-    },
+  const stdio = serveStdio(
+    () =>
+      createMCPServerForRequest(
+        {
+          name: appId.charAt(0).toUpperCase() + appId.slice(1),
+          appId,
+          description: `Agent-native ${appId} app (standalone MCP)`,
+          actions,
+          // No askAgent in standalone — there is no running engine/runtime here.
+          // builtin cross-app tools stay on so `list_apps` / `open_app` /
+          // `create_workspace_app` / `list_templates` still work from disk.
+        },
+        // No verified identity in standalone (no inbound auth header). Runs with
+        // platform-default scope, same as a tokenless local HTTP mount.
+        undefined,
+        {
+          origin,
+          clientName: "agent-native-mcp-standalone",
+          // Compact by default; opt into the full catalog with the env flag.
+          fullCatalog: process.env.AGENT_NATIVE_MCP_FULL_CATALOG === "1",
+        },
+      ),
+    { legacy: "serve" },
   );
 
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
-
   await new Promise<void>((resolve) => {
-    const done = () => resolve();
-    transport.onclose = done;
-    process.once("SIGINT", done);
-    process.once("SIGTERM", done);
+    process.stdin.once("end", resolve);
+    process.once("SIGINT", resolve);
+    process.once("SIGTERM", resolve);
   });
+  await stdio.close();
 }
 
 /**

package/src/mcp-client/manager.ts

@@ -228,8 +228,7 @@ export class McpClientManager {
       // If we previously loaded without stdio and now need it, top up.
       if (needStdio && !this.sdk.StdioClientTransport && isNode()) {
         try {
-          const stdioMod =
-            await import("@modelcontextprotocol/sdk/client/stdio.js");
+          const stdioMod = await import("@modelcontextprotocol/client/stdio");
           this.sdk.StdioClientTransport = stdioMod.StdioClientTransport;
         } catch (err: any) {
           console.warn(
@@ -240,15 +239,11 @@ export class McpClientManager {
       return this.sdk;
     }
     try {
-      const clientMod =
-        await import("@modelcontextprotocol/sdk/client/index.js");
-      const httpMod =
-        await import("@modelcontextprotocol/sdk/client/streamableHttp.js");
+      const clientMod = await import("@modelcontextprotocol/client");
       let StdioClientTransport: any = null;
       if (needStdio && isNode()) {
         try {
-          const stdioMod =
-            await import("@modelcontextprotocol/sdk/client/stdio.js");
+          const stdioMod = await import("@modelcontextprotocol/client/stdio");
           StdioClientTransport = stdioMod.StdioClientTransport;
         } catch (err: any) {
           console.warn(
@@ -259,7 +254,7 @@ export class McpClientManager {
       this.sdk = {
         Client: clientMod.Client,
         StdioClientTransport,
-        StreamableHTTPClientTransport: httpMod.StreamableHTTPClientTransport,
+        StreamableHTTPClientTransport: clientMod.StreamableHTTPClientTransport,
       };
       return this.sdk;
     } catch (err: any) {
@@ -450,6 +445,7 @@ export class McpClientManager {
             },
           },
         },
+        versionNegotiation: { mode: "auto" },
       } as any,
     );
     const recordConnectionError: ErrorSink = () => {};
@@ -459,7 +455,7 @@ export class McpClientManager {
     // Attach a transport-level error handler before connect() so the SDK's
     // internal fire-and-forget paths (initial SSE stream open, scheduled
     // reconnects, message-handler-triggered reconnects — see processStream()
-    // in @modelcontextprotocol/sdk/client/streamableHttp.js) cannot leak as
+    // in @modelcontextprotocol/client) cannot leak as
     // unhandled promise rejections. On AWS Lambda the long-lived socket
     // gets reaped ~60s after the function returns; without this handler the
     // resulting `socket hang up` surfaces as an unhandledRejection and