opentel-mcp 0.18.0 → 0.18.1

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 0.18.1
+
+A patch release: no new features and no change to the signals or metrics
+(no new attribute or metric label keys).
+
+### Fixed
+
+- **No more deprecation warnings on install.** `@opentelemetry/sdk-trace-node`
+  and `@opentelemetry/sdk-trace-base` are deprecated upstream (`npm warn
+  deprecated ... Use @opentelemetry/sdk-trace package`). The dev-mode tracer
+  (`setupNodeSdk: true`) now uses the supported `@opentelemetry/sdk-trace`
+  (`TracerProvider`). The old `NodeTracerProvider.register()` also installed
+  the global async-context manager and the W3C trace-context + baggage
+  propagator, so those are now registered explicitly, with
+  `@opentelemetry/context-async-hooks` and `@opentelemetry/core` as direct
+  dependencies (both were already in the install tree). Span processors, the
+  stderr exporter, OTLP export, `flushOnExit` and the single-shutdown guarantee
+  are unchanged, and `OTEL_BSP_*` batch tuning keeps working. One difference
+  to know about: the replacement SDK package no longer reads `OTEL_TRACES_SAMPLER*`
+  and `OTEL_SPAN_*_LIMIT` from the environment, so the dev-mode provider
+  always uses the default sampler (parent-based, always on) and default span
+  limits. Only hosts that set those variables *and* use `setupNodeSdk: true`
+  are affected; hosts that bring their own provider are not.
+
+### Release process
+
+- **First release published with npm provenance via the release workflow.**
+  0.18.0 (and earlier) were published manually and carry no provenance.
+
 ## 0.18.0
 
 Security observability: five small signals that help you notice some attacks
@@ -9,8 +38,8 @@ of it records tool arguments, result content, tool descriptions or matched
 secrets (derived signals only: booleans, counts, type names, hashes, tool
 names). Every new feature is off by default except the auth failure counter,
 which adds no new data. No new metric label keys. Python (0.1.0) is not
-affected; these signals are JS-only (ADR 034). This is the first release made
-by the signed release workflow (npm provenance, SBOM).
+affected; these signals are JS-only (ADR 034). (Correction, see 0.18.1: this
+release was published by hand and has no npm provenance or SBOM.)
 
 ### Security
 

package/README.md

@@ -429,7 +429,7 @@ SigNoz's local OTLP endpoint:
 import { metrics, trace } from '@opentelemetry/api';
 import { MeterProvider, PeriodicExportingMetricReader } from '@opentelemetry/sdk-metrics';
 import { OTLPMetricExporter } from '@opentelemetry/exporter-metrics-otlp-http';
-import { NodeTracerProvider, BatchSpanProcessor } from '@opentelemetry/sdk-trace-node';
+import { TracerProvider, BatchSpanProcessor } from '@opentelemetry/sdk-trace';
 import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http';
 import { resourceFromAttributes } from '@opentelemetry/resources';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
@@ -447,7 +447,7 @@ const meterProvider = new MeterProvider({
 });
 metrics.setGlobalMeterProvider(meterProvider);
 
-const tracerProvider = new NodeTracerProvider({
+const tracerProvider = new TracerProvider({
   resource,
   spanProcessors: [new BatchSpanProcessor(new OTLPTraceExporter({ url: 'http://localhost:4318/v1/traces' }))],
 });
@@ -464,7 +464,7 @@ instrumentMcpServer(server, {});
 Protocol — the wire format traces/metrics travel over) endpoint; point it
 at your own collector in production. `@opentelemetry/exporter-metrics-otlp-http`
 is a host-app dependency — opentel-mcp doesn't bundle it. `@opentelemetry/sdk-metrics`,
-`@opentelemetry/sdk-trace-node`, and `@opentelemetry/exporter-trace-otlp-http`
+`@opentelemetry/sdk-trace`, and `@opentelemetry/exporter-trace-otlp-http`
 are already runtime dependencies of opentel-mcp itself (`@opentelemetry/sdk-metrics`
 as of v0.15.0, for the dev-mode metrics path below; the other two for
 `setupNodeSdk: true`'s dev tracing path, same as before), so no extra
@@ -537,7 +537,7 @@ nothing — your application owns its providers and its shutdown. Design:
 as of this feature — not an optional peer, not a dynamic import with a
 fallback path. See ADR 023's "Dependency strategy" section for the full
 reasoning: its own transitive dependencies were already in this package's
-tree via `@opentelemetry/resources`/`@opentelemetry/sdk-trace-node`, so
+tree via `@opentelemetry/resources`/`@opentelemetry/sdk-trace`, so
 this adds no new package beyond itself.
 
 #### Using the Prometheus exporter instead of OTLP — `service.name` needs an extra option
@@ -2957,7 +2957,7 @@ truth: `src/config.js`.
 
 [^9]: `{ enabled?: boolean; pricingTable?: PricingTable; extractor?: UsageExtractor; budget?: { perSessionUsd?: number; perToolUsd?: number } }`, all fields optional and individually defaulted — `{ enabled: true, pricingTable: DEFAULT_PRICING, extractor: defaultExtractor }` with budget tracking off.
 [^2]: Required only when `setupNodeSdk` is `true`. Has no effect otherwise — the host app's registered `TracerProvider` owns the resource; passing it anyway logs a one-time `diag.warn`.
-[^3]: Creates and registers a `NodeTracerProvider` that always prints to stderr (safe alongside stdio-transport servers — ADR 003), additionally exporting via OTLP/HTTP if `exporterUrl` is set.
+[^3]: Creates and registers a `TracerProvider` that always prints to stderr (safe alongside stdio-transport servers — ADR 003), additionally exporting via OTLP/HTTP if `exporterUrl` is set.
 [^4]: Only takes effect when `setupNodeSdk` is `true`.
 
 ## Ordering constraint
@@ -3314,7 +3314,7 @@ one looping agent apart from several unrelated callers of that same tool.
 
 ### Quick dev setup
 
-`setupNodeSdk: true` sets up a `NodeTracerProvider` that prints spans to
+`setupNodeSdk: true` sets up a `TracerProvider` that prints spans to
 stderr (safe alongside stdio-transport MCP servers — see ADR 003),
 optionally plus an OTLP exporter if `exporterUrl` is provided. No separate
 OTel SDK setup needed — `serviceName` is required in this mode, since it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opentel-mcp",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "description": "One-line OpenTelemetry instrumentation for Model Context Protocol (MCP) servers",
   "type": "module",
   "main": "src/index.js",
@@ -67,17 +67,17 @@
     }
   },
   "dependencies": {
+    "@opentelemetry/context-async-hooks": "^2.9.0",
+    "@opentelemetry/core": "^2.9.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.220.0",
     "@opentelemetry/resources": "^2.9.0",
     "@opentelemetry/sdk-metrics": "^2.9.0",
-    "@opentelemetry/sdk-trace-node": "^2.9.0"
+    "@opentelemetry/sdk-trace": "^2.9.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "1.32.1",
     "@modelcontextprotocol/server": "2.3.1",
     "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/context-async-hooks": "^2.9.0",
-    "@opentelemetry/sdk-trace-base": "^2.9.0",
     "@vitest/coverage-v8": "^4.1.12",
     "js-yaml": "^4.3.1",
     "typescript": "^7.0.2",

package/src/config.js

@@ -41,7 +41,7 @@ import { resolveToolIntegrityConfig } from './tool-integrity/config.js';
 
 /**
  * @typedef {object} InstrumentOptions
- * @property {string} [serviceName] - Names the resource of the NodeTracerProvider this library creates.
+ * @property {string} [serviceName] - Names the resource of the TracerProvider this library creates.
  *   Required (and must be a non-empty string) when `setupNodeSdk` is true. Has no effect when `setupNodeSdk`
  *   is false or omitted — in that mode, resource attributes (including `service.name`) come from whatever
  *   TracerProvider the host application has already registered; passing `serviceName` anyway is harmless but
@@ -55,7 +55,7 @@ import { resolveToolIntegrityConfig } from './tool-integrity/config.js';
  *   @opentelemetry/api behavior — so this flag exists for opting out even when one *is* registered, not as a
  *   substitute for that default.
  * @property {boolean} [setupNodeSdk=false] - When true, instrumentMcpServer() creates and registers its own
- *   NodeTracerProvider (always exporting to stderr — safe alongside stdio-transport MCP servers, see ADR 003;
+ *   TracerProvider (always exporting to stderr — safe alongside stdio-transport MCP servers, see ADR 003;
  *   additionally to `exporterUrl` via OTLP/HTTP if set). When false (the default), spans are emitted via
  *   whatever OpenTelemetry TracerProvider the host application
  *   has already registered globally — or dropped silently if none has been registered. This default keeps

package/src/index.d.ts

@@ -9,7 +9,7 @@ import type { ObservationState } from './observation/types.d.ts';
  */
 export interface InstrumentOptions {
   /**
-   * Names the resource of the `NodeTracerProvider` this library creates.
+   * Names the resource of the `TracerProvider` this library creates.
    *
    * Required (and must be a non-empty string) when `setupNodeSdk` is `true` —
    * omitting it in that mode throws at runtime. Has no effect when
@@ -56,7 +56,7 @@ export interface InstrumentOptions {
 
   /**
    * When `true`, {@link instrumentMcpServer} creates and registers its own
-   * `NodeTracerProvider` (always exporting to stderr; additionally to
+   * `TracerProvider` (always exporting to stderr; additionally to
    * `exporterUrl` via OTLP/HTTP if set).
    *
    * **Also stands up a dev-mode `MeterProvider` (ADR 023,
@@ -488,7 +488,7 @@ export type DuckTypedMcpServer = {
  * @param options - Instrumentation options.
  * @returns The same object that was passed in, for chaining. When
  *   `options.setupNodeSdk` is `true`, the returned object also gets a
- *   `shutdown()` method that flushes and shuts down the `NodeTracerProvider`
+ *   `shutdown()` method that flushes and shuts down the `TracerProvider`
  *   created for it — call it during your process's own shutdown sequence to
  *   avoid losing buffered spans. As of v0.15.0 (ADR 023), when dev-mode
  *   metrics were also set up (`enableMetrics` not `false`, and no

package/src/instrument.js

@@ -4,9 +4,11 @@
 
 import { createRequire } from 'node:module';
 import { randomUUID } from 'node:crypto';
-import { trace, metrics, diag, SpanStatusCode, SpanKind } from '@opentelemetry/api';
+import { trace, metrics, context, propagation, diag, SpanStatusCode, SpanKind } from '@opentelemetry/api';
 import { getV1Sdk, getV2Sdk } from './sdk/detect.js';
-import { NodeTracerProvider, SimpleSpanProcessor, BatchSpanProcessor } from '@opentelemetry/sdk-trace-node';
+import { TracerProvider, SimpleSpanProcessor, BatchSpanProcessor } from '@opentelemetry/sdk-trace';
+import { AsyncLocalStorageContextManager } from '@opentelemetry/context-async-hooks';
+import { CompositePropagator, W3CTraceContextPropagator, W3CBaggagePropagator, getNumberFromEnv } from '@opentelemetry/core';
 import { MeterProvider, PeriodicExportingMetricReader } from '@opentelemetry/sdk-metrics';
 import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http';
 import { resourceFromAttributes } from '@opentelemetry/resources';
@@ -350,7 +352,7 @@ function detectServerKind(input) {
  * @returns {*} The same object that was passed in, for chaining. When
  *   `options.setupNodeSdk` is true, the inner Server (and, when instrumenting
  *   an McpServer, the outer object too) gets a `shutdown()` method that
- *   flushes and shuts down the NodeTracerProvider created for it — call it
+ *   flushes and shuts down the TracerProvider created for it — call it
  *   during your process's own shutdown sequence to avoid losing buffered
  *   spans. When `setupNodeSdk` is false (the default), no `shutdown()` is
  *   attached; lifecycle of the global provider belongs to whoever
@@ -980,9 +982,29 @@ export function __resetMeterProviderWarnedForTests() {
   warnedMeterProviderAlreadyRegistered = false;
 }
 
+/**
+ * The deprecated sdk-trace-base BatchSpanProcessor read the spec's
+ * OTEL_BSP_* variables itself; the sdk-trace one only takes explicit
+ * options, so the same four are read here to keep tuning via env working.
+ * Unset (or invalid) values are omitted, leaving the SDK defaults.
+ */
+function batchProcessorConfigFromEnv() {
+  /** @type {Record<string, number>} */
+  const config = {};
+  const read = (key, name) => {
+    const value = getNumberFromEnv(name);
+    if (value !== undefined) config[key] = value;
+  };
+  read('maxQueueSize', 'OTEL_BSP_MAX_QUEUE_SIZE');
+  read('maxExportBatchSize', 'OTEL_BSP_MAX_EXPORT_BATCH_SIZE');
+  read('scheduledDelayMillis', 'OTEL_BSP_SCHEDULE_DELAY');
+  read('exportTimeoutMillis', 'OTEL_BSP_EXPORT_TIMEOUT');
+  return config;
+}
+
 /**
  * Resolves the Tracer to use for this server, optionally standing up an
- * owned NodeTracerProvider (and, per ADR 023, an owned dev-mode
+ * owned TracerProvider (and, per ADR 023, an owned dev-mode
  * MeterProvider) first.
  *
  * @param {import('@modelcontextprotocol/sdk/server/index.js').Server} server
@@ -994,9 +1016,9 @@ function setupTracer(server, resolved) {
     // StderrSpanExporter, not ConsoleSpanExporter — stdio-transport MCP
     // servers write JSON-RPC to stdout, so diagnostic span output must go
     // to stderr instead or it corrupts the protocol stream. See ADR 003.
-    const spanProcessors = [new SimpleSpanProcessor(new StderrSpanExporter())];
+    const spanProcessors = [new SimpleSpanProcessor({ exporter: new StderrSpanExporter() })];
     if (resolved.exporterUrl) {
-      spanProcessors.push(new BatchSpanProcessor(new OTLPTraceExporter({ url: resolved.exporterUrl })));
+      spanProcessors.push(new BatchSpanProcessor({ exporter: new OTLPTraceExporter({ url: resolved.exporterUrl }), ...batchProcessorConfigFromEnv() }));
     }
 
     // ADR 016 point 3: only attached when DEFAULT_PRICING is actually
@@ -1014,8 +1036,21 @@ function setupTracer(server, resolved) {
     // mode — one Resource construction, not two independently-built ones.
     const resource = resourceFromAttributes({ 'service.name': resolved.serviceName, ...pricingResourceAttributes });
 
-    const provider = new NodeTracerProvider({ resource, spanProcessors });
-    provider.register();
+    // @opentelemetry/sdk-trace-node (deprecated) bundled a NodeTracerProvider
+    // whose register() also installed the global async context manager and
+    // W3C propagator; the replacement sdk-trace TracerProvider has no
+    // register(), so the same three globals are set explicitly here to keep
+    // dev-mode behavior (async context propagation, trace-context
+    // propagation) identical. Each setter is first-wins and returns false
+    // when something is already registered — same as register() did.
+    const provider = new TracerProvider({ resource, spanProcessors });
+    trace.setGlobalTracerProvider(provider);
+    const contextManager = new AsyncLocalStorageContextManager();
+    contextManager.enable();
+    context.setGlobalContextManager(contextManager);
+    propagation.setGlobalPropagator(
+      new CompositePropagator({ propagators: [new W3CTraceContextPropagator(), new W3CBaggagePropagator()] }),
+    );
 
     // ADR 023 (v0.15.0): dev-mode metrics. Only attempted when metrics
     // aren't separately opted out via enableMetrics: false — a host who's